CVE-2025-64765

Astro is a web framework. Prior to version 5.15.8, a mismatch exists between how Astro normalizes request paths for routing/rendering and how the application’s middleware reads the path for validation checks. Astro internally applies decodeURI() to determine which route to render, while the middleware uses context.url.pathname without applying the same normalization (decodeURI). This discrepancy may allow attackers to reach protected routes using encoded path variants that pass routing but bypass validation checks. This issue has been patched in version 5.15.8.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/withastro/astro/commit/6f800813516b07bbe12c666a92937525fddb58ce	Patch
https://github.com/withastro/astro/security/advisories/GHSA-ggxq-hp9w-j794	Exploit Mitigation Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:astro:astro:*:*:*:*:*:node.js:*:*

History

18 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Astro es un web framework. Versiones anteriores a la versión 5.15.8, existe una discrepancia entre cómo Astro normaliza las rutas de solicitud para el enrutamiento/renderizado y cómo el middleware de la aplicación lee la ruta para las comprobaciones de validación. Astro aplica internamente decodeURI() para determinar qué ruta renderizar, mientras que el middleware utiliza context.url.pathname sin aplicar la misma normalización (decodeURI). Esta discrepancia puede permitir a los atacantes alcanzar rutas protegidas utilizando variantes de ruta codificadas que pasan el enrutamiento pero eluden las comprobaciones de validación. Este problema ha sido parcheado en la versión 5.15.8.

Information

Published : 2025-11-19 17:15

Updated : 2026-10-18 20:10

NVD link : CVE-2025-64765

Mitre link : CVE-2025-64765

CVE.ORG link : CVE-2025-64765

JSON object : View

Products Affected

astro

astro

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2025-64765", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-64765", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-20T15:50:37.171718Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "withastro", "product": "astro", "versions": [{"status": "affected", "version": "< 5.15.8"}]}]}], "published": "2025-11-19T17:15:52.827", "references": [{"url": "https://github.com/withastro/astro/commit/6f800813516b07bbe12c666a92937525fddb58ce", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/withastro/astro/security/advisories/GHSA-ggxq-hp9w-j794", "tags": ["Exploit", "Mitigation", "Third Party Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "Astro is a web framework. Prior to version 5.15.8, a mismatch exists between how Astro normalizes request paths for routing/rendering and how the application\u2019s middleware reads the path for validation checks. Astro internally applies decodeURI() to determine which route to render, while the middleware uses context.url.pathname without applying the same normalization (decodeURI). This discrepancy may allow attackers to reach protected routes using encoded path variants that pass routing but bypass validation checks. This issue has been patched in version 5.15.8."}, {"lang": "es", "value": "Astro es un web framework. Versiones anteriores a la versi\u00f3n 5.15.8, existe una discrepancia entre c\u00f3mo Astro normaliza las rutas de solicitud para el enrutamiento/renderizado y c\u00f3mo el middleware de la aplicaci\u00f3n lee la ruta para las comprobaciones de validaci\u00f3n. Astro aplica internamente decodeURI() para determinar qu\u00e9 ruta renderizar, mientras que el middleware utiliza context.url.pathname sin aplicar la misma normalizaci\u00f3n (decodeURI). Esta discrepancia puede permitir a los atacantes alcanzar rutas protegidas utilizando variantes de ruta codificadas que pasan el enrutamiento pero eluden las comprobaciones de validaci\u00f3n. Este problema ha sido parcheado en la versi\u00f3n 5.15.8."}], "lastModified": "2026-10-18T20:10:00.110", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:astro:astro:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "1015DFA8-9106-453C-9144-11E63ADA3B67", "versionEndExcluding": "5.15.8"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}