Skip to content
Threat Feed
Subscribe

Product

Astro (>= 6.4.7, < 6.4.8)

1 brief RSS
high advisory

Astro Authorization Bypass via Iterative Decode Limit and Canonicalization Mismatch

An authorization bypass vulnerability exists in Astro versions >= 6.4.7 and < 6.4.8, caused by a mismatch in URL path canonicalization, allowing an unauthenticated attacker to bypass middleware protections and access protected routes if the application relies on pathname-based authorization and uses rewrite behavior that performs route matching after middleware execution.

Astro authorization-bypass web-vulnerability nodejs
1r 2t 1c