Path Validation Flaw in Astro Web Framework by Astro

CVE-2025-64765

What is CVE-2025-64765?

The Astro Web Framework contains a vulnerability that arises from a discrepancy in how request paths are normalized for routing compared to how the application middleware validates those paths. Specifically, Astro uses decodeURI() to normalize the request paths for rendering routes, while the middleware relies on context.url.pathname without applying similar normalization. This inconsistency allows attackers to access protected routes by using encoded path variants that can bypass necessary validation checks. The issue has been addressed in version 5.15.8, emphasizing the importance of upgrading to maintain security integrity.

References