CVE-2025-66202 Details

A double URL encoding bypass vulnerability has been identified in the Astro web framework, affecting versions prior to 5.15.8. This vulnerability allows unauthenticated attackers to bypass path-based authentication checks in Astro middleware, granting unauthorized access to protected routes. The issue arises because Astro applies URL decoding for routing and rendering, but the middleware validation checks use the raw, encoded URL path. As a result, attackers can exploit this mismatch by sending double-encoded URLs that bypass authentication checks for routes like '/admin' or '/api/internal'.

Users are advised to update to Astro version 5.15.8 or later, where this vulnerability has been addressed. After updating, ensure that middleware context uses the same normalized pathname value that Astro applies internally to prevent any bypass of authentication checks.