PT-2026-56516 · Astro · Astro

Published 2026-07-08 · Updated 2026-07-08 · CVE-2026-59731

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Astro version 6.4.7

Description Astro performs authorization decisions on a partially decoded pathname after reaching the iterative URL decoder limit. Subsequently, rewrite route matching performs an additional decodeURI() operation, which can allow a request to resolve to a protected route.

Recommendations Update to version 6.4.8.

Fix

Weakness Enumeration

CWE-647

Related Identifiers

CVE-2026-59731

Affected Products

Astro

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-59731 · Security Note
• https://github.com/withastro/astro/releases/tag/astro@6.4.8 · Note
• https://github.com/withastro/astro/pull/17109 · Note
• https://github.com/withastro/astro/commit/27c80ea92248993e5fce94b2c26d87d611ab6785 · Note
• https://github.com/withastro/astro/security/advisories/GHSA-vj59-8hwv-xxmv · Note
• https://twitter.com/CVEnew/status/2074931615675912463 · Twitter Post
• https://twitter.com/infoflowcloud/status/2074932988018630675 · Twitter Post