CVE-2025-66202: Astro Authentication Bypass via Double URL Encoding
Summary
CVE-2025-66202: Astro has an Authentication Bypass via Double URL Encoding, a bypass for CVE-2025-64765. Affects astro versions < 5.15.8. Fixed in 5.15.8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Astro is a modern static site generator that allows developers to build fast websites using their favorite frameworks. It provides a flexible architecture for rendering content and managing routes. However, it has been found to be vulnerable to an authentication bypass issue due to improper handling of URL encoding, which can lead to unauthorized access to protected routes.
Vulnerability Detail
The vulnerability arises from a double URL encoding bypass that allows unauthenticated attackers to circumvent path-based authentication checks in Astro middleware. This issue is a continuation of the previously identified CVE-2025-64765, which addressed single URL encoding. The fix for the earlier vulnerability was inadequate as it only decoded the URL once. Attackers can exploit this by using double-encoded URLs, such as '/%2561dmin', to access restricted areas like '/admin' or '/api/internal'. This can lead to unauthorized access to sensitive resources and potential data breaches.
How To Fix
Latest published version: 7.4.2 as of 23 Oct 2026
npm install astro@7.4.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
5.15.8
This is the first release that contains the fix.
npm install astro@5.15.8Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not possible, implement a workaround by adding a check for multi-level URL encoding in your middleware. Use the following code snippet to reject requests with encoded characters:
if (containsEncodedCharacters(pathname)) {
// Multi-level encoding detected - reject request
return new Response(
'Bad Request: Multi-level URL encoding is not allowed',
{
status: 400,
headers: { 'Content-Type': 'text/plain' }
}
);
}
Conclusion
The CVE-2025-66202 vulnerability in Astro represents a significant security risk due to its ability to allow unauthorized access through double URL encoding. It is crucial to update to the patched version to mitigate this risk. Additionally, implementing the suggested workaround can provide temporary protection while you prepare for the update.
See every vulnerability recorded for astro →
FAQ
The vulnerability allows attackers to bypass authentication checks through double URL encoding, granting unauthorized access to protected routes.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to analyze your package-lock.json.
If exploited, this vulnerability can lead to unauthorized access to sensitive areas of your application, potentially resulting in data breaches or unauthorized data manipulation.
Yes, the vulnerability has been patched in Astro version 5.15.8. It is recommended to update to this version or later.
If you cannot update immediately, implement the provided workaround to reject requests with multi-level URL encoding until you can apply the patch.
References
Related vulnerabilities
Recent vulnerabilities recorded for astro.
