ghsa-ggxq-hp9w-j794
Vulnerability from github
A mismatch exists between how Astro normalizes request paths for routing/rendering and how the application’s middleware reads the path for validation checks. Astro internally applies decodeURI() to determine which route to render, while the middleware uses context.url.pathname without applying the same normalization (decodeURI).
This discrepancy may allow attackers to reach protected routes (e.g., /admin) using encoded path variants that pass routing but bypass validation checks.
https://github.com/withastro/astro/blob/ebc4b1cde82c76076d5d673b5b70f94be2c066f3/packages/astro/src/vite-plugin-astro-server/request.ts#L40-L44
``js
/** The main logic to route dev server requests to pages in Astro. */
export async function handleRequest({
pipeline,
routesList,
controller,
incomingRequest,
incomingResponse,
}: HandleRequest) {
const { config, loader } = pipeline;
const origin =${loader.isHttps() ? 'https' : 'http'}://${
incomingRequest.headers[':authority'] ?? incomingRequest.headers.host
}`;
const url = new URL(origin + incomingRequest.url);
let pathname: string;
if (config.trailingSlash === 'never' && !incomingRequest.url) {
pathname = '';
} else {
// We already have a middleware that checks if there's an incoming URL that has invalid URI, so it's safe
// to not handle the error: packages/astro/src/vite-plugin-astro-server/base.ts
pathname = decodeURI(url.pathname); // here this url is for routing/rendering
}
// Add config.base back to url before passing it to SSR
url.pathname = removeTrailingForwardSlash(config.base) + url.pathname; // this is used for middleware context
```
Consider an application having the following middleware code:
```js import { defineMiddleware } from "astro/middleware";
export const onRequest = defineMiddleware(async (context, next) => { const isAuthed = false; // simulate no auth if (context.url.pathname === "/admin" && !isAuthed) { return context.redirect("/"); } return next(); }); ```
context.url.pathname is validated , if it's equal to /admin the isAuthed property must be true for the next() method to be called. The same example can be found in the official docs https://docs.astro.build/en/guides/authentication/
context.url.pathname returns the raw version which is /%61admin while pathname which is used for routing/rendering /admin, this creates a path normalization mismatch.
By sending the following request, it's possible to bypass the middleware check
GET /%61dmin HTTP/1.1
Host: localhost:3000
Remediation
Ensure middleware context has the same normalized pathname value that Astro uses internally, because any difference could allow it to bypass such checks. In short maybe something like this
```diff pathname = decodeURI(url.pathname); }
// Add config.base back to url before passing it to SSR
- url.pathname = removeTrailingForwardSlash(config.base) + url.pathname;
- url.pathname = removeTrailingForwardSlash(config.base) + decodeURI(url.pathname); ```
Thank you, let @Sudistark know if any more info is needed. Happy to help :)
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "astro"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "5.15.8"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-64765"
],
"database_specific": {
"cwe_ids": [
"CWE-22"
],
"github_reviewed": true,
"github_reviewed_at": "2025-11-19T20:03:21Z",
"nvd_published_at": "2025-11-19T17:15:52Z",
"severity": "MODERATE"
},
"details": "A mismatch exists between how Astro normalizes request paths for routing/rendering and how the application\u2019s middleware reads the path for validation checks. Astro internally applies `decodeURI()` to determine which route to render, while the middleware uses `context.url.pathname` without applying the same normalization (decodeURI).\n\nThis discrepancy may allow attackers to reach protected routes (e.g., /admin) using encoded path variants that pass routing but bypass validation checks.\n\nhttps://github.com/withastro/astro/blob/ebc4b1cde82c76076d5d673b5b70f94be2c066f3/packages/astro/src/vite-plugin-astro-server/request.ts#L40-L44\n\n```js\n/** The main logic to route dev server requests to pages in Astro. */\nexport async function handleRequest({\n pipeline,\n routesList,\n controller,\n incomingRequest,\n incomingResponse,\n}: HandleRequest) {\n const { config, loader } = pipeline;\n const origin = `${loader.isHttps() ? \u0027https\u0027 : \u0027http\u0027}://${\n incomingRequest.headers[\u0027:authority\u0027] ?? incomingRequest.headers.host\n }`;\n\n const url = new URL(origin + incomingRequest.url);\n let pathname: string;\n if (config.trailingSlash === \u0027never\u0027 \u0026\u0026 !incomingRequest.url) {\n pathname = \u0027\u0027;\n } else {\n // We already have a middleware that checks if there\u0027s an incoming URL that has invalid URI, so it\u0027s safe\n // to not handle the error: packages/astro/src/vite-plugin-astro-server/base.ts\n pathname = decodeURI(url.pathname); // here this url is for routing/rendering\n }\n\n // Add config.base back to url before passing it to SSR\n url.pathname = removeTrailingForwardSlash(config.base) + url.pathname; // this is used for middleware context\n```\n\nConsider an application having the following middleware code:\n\n```js\nimport { defineMiddleware } from \"astro/middleware\";\n\nexport const onRequest = defineMiddleware(async (context, next) =\u003e {\n const isAuthed = false; // simulate no auth\n if (context.url.pathname === \"/admin\" \u0026\u0026 !isAuthed) {\n return context.redirect(\"/\");\n }\n return next();\n});\n```\n\n`context.url.pathname` is validated , if it\u0027s equal to `/admin` the `isAuthed` property must be true for the next() method to be called. The same example can be found in the official docs https://docs.astro.build/en/guides/authentication/\n\n\n`context.url.pathname` returns the raw version which is `/%61admin` while pathname which is used for routing/rendering `/admin`, this creates a path normalization mismatch.\n\nBy sending the following request, it\u0027s possible to bypass the middleware check\n\n```\nGET /%61dmin HTTP/1.1\nHost: localhost:3000\n```\n\n\u003cimg width=\"1920\" height=\"1025\" alt=\"image\" src=\"https://github.com/user-attachments/assets/7e0eeecd-607a-4c73-b12e-5977a30c9bc4\" /\u003e\n\n\n**Remediation**\n\nEnsure middleware context has the same normalized pathname value that Astro uses internally, because any difference could allow it to bypass such checks. In short maybe something like this\n\n```diff\n pathname = decodeURI(url.pathname);\n }\n\n // Add config.base back to url before passing it to SSR\n- url.pathname = removeTrailingForwardSlash(config.base) + url.pathname;\n+ url.pathname = removeTrailingForwardSlash(config.base) + decodeURI(url.pathname);\n```\n\nThank you, let @Sudistark know if any more info is needed. Happy to help :)",
"id": "GHSA-ggxq-hp9w-j794",
"modified": "2025-11-27T08:14:43Z",
"published": "2025-11-19T20:03:21Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/withastro/astro/security/advisories/GHSA-ggxq-hp9w-j794"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64765"
},
{
"type": "WEB",
"url": "https://github.com/withastro/astro/commit/6f800813516b07bbe12c666a92937525fddb58ce"
},
{
"type": "PACKAGE",
"url": "https://github.com/withastro/astro"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Astro\u0027s middleware authentication checks based on url.pathname can be bypassed via url encoded values"
}
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.