CVE-2026-59731: Withastro Astro

High severity, CVSS 8.2. EPSS: 0.5% chance of exploitation in the next 30 days.

Astro is a web framework for content-driven websites. Version 6.4.7 performs authorization decisions on a partially decoded pathname after reaching the iterative URL decoder limit, while later rewrite route matching performs an additional decodeURI() operation and can resolve the request to a protected route. This issue is fixed in version 6.4.8.

Affected products

• Withastro Astro: from 6.4.7, before 6.4.8 (fixed in 6.4.8)

Published 2026-07-08. Last modified 2026-07-09.