Advisory analysisEclso / withastroSource: EIP research review
Astro 6.4.7 Authorization Bypass via Decode Iteration Limit and Rewrite Path Canonicalization Mismatch
Astro 6.4.7 reintroduces a middleware authorization bypass when a request path is encoded more deeply than the iterative URL decoder's maximum decoding depth of 10 iterations. The decoder returns a partially decoded pathname after reaching the cap, while later route matching performs an additional decodeURI() and resolves the request to a protected route. At encoding depth 11, middleware sees /%61dmin and allows the request, while the router decodes it to /admin and serves protected content. Exploitation requires pathname-based authorization checks in middleware combined with rewrite-based routing (next(context.url)). Fixed in Astro 6.4.8 by rejecting requests when decoding has not stabilized before reaching the iteration cap.
Root causeTechnical detailMitigation
https://github.com/withastro/astro/security/advisories/GHSA-vj59-8hwv-xxmv Research notes
- Root causeAstro 6.4.7 introduced iterative URI decoding capped at 10 iterations. When encoding depth exceeds the cap, the decoder returns a partially decoded pathname instead of rejecting the request. Later route matching performs an additional independent decodeURI(), creating a canonicalization mismatch between authorization and routing.
- Technical detailAt encoding depth 11, middleware sees /%61dmin (partially decoded) while the router decodes it to /admin and serves protected content. The bypass requires pathname-based authorization checks in middleware combined with rewrite-based routing (next(context.url)).
- MitigationFixed in Astro 6.4.8. The recommended fix is to reject requests when decoding has not stabilized before reaching the iteration cap, rather than returning partially decoded pathnames.