Listen to this Post
The vulnerability is a logic flaw in how Astro middleware processed and normalized URL paths for authentication checks. A previous fix for CVE-2025-64765 in Astro v5.15.8 attempted to address single-level URL encoding (e.g., `/%61dmin` for /admin) by decoding the pathname once before middleware evaluation. This fix was incomplete. An attacker can bypass it by double-encoding the URL. For example, to access a protected `/admin` route, an attacker would send /%2561dmin. The `%25` is the percent-encoded character for `%` itself. The initial single decode in the vulnerable Astro version would transform `/%2561dmin` into /%61dmin, leaving a remaining encoded character (%61). The middleware’s pathname check would then compare the still-encoded string `/%61dmin` against the protected pattern /admin, failing to recognize a match and allowing the request through. The request proceeds to the application, which typically performs a final decode, interpreting `%61` as a, ultimately serving the protected `/admin` route without proper authorization.
DailyCVE Form
Platform: Astro web framework
Version: Under 5.15.8
Vulnerability: Double URL encoding
Severity: Medium (CVSS 6.5)
Date: 2025-12-08
Prediction: Patched 2025-12-04
What Undercode Say:
Analytics
Check current Astro version in project npm list astro Upgrade Astro to the patched version npm install astro@^5.15.8
How Exploit:
An unauthenticated attacker sends an HTTP request to a protected route using a double-encoded URL path.
GET /%2561pi/internal HTTP/1.1 Host: vulnerable-app.com
The flawed middleware normalizes `%25` to %, resulting in /%61pi/internal, which does not match the protected `/api/internal` path rule, bypassing the check.
Protection from this CVE
Upgrade to Astro version 5.15.8 or later. The complete fix, as seen in v5.16.3, decodes the pathname and then validates that no encoded characters (%xx) remain before passing it to middleware.
// Secure validation logic
if (containsEncodedCharacters(pathname)) {
return new Response('Bad Request', { status: 400 });
}
Impact:
Unauthorized access to protected application routes (e.g., /admin, /api/internal). Potential for information disclosure or privilege escalation.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
