https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 09:34:11 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-261461 EUVD-2026-261461 https://cve.radiocsirt.org/vuln/euvd-2026-261461 https://cve.radiocsirt.org/vuln/fkie_cve-2025-64765 <p>Astro is a web framework. Prior to version 5.15.8, a mismatch exists between how Astro normalizes request paths for routing/rendering and how the application’s middleware reads the path for validation checks. Astro internally applies decodeURI() to determine which route to render, while the middleware uses context.url.pathname without applying the same normalization (decodeURI). This discrepancy may allow attackers to reach protected routes using encoded path variants that pass routing but bypass validation checks. This issue has been patched in version 5.15.8.</p> <p>Astro is a web framework. Prior to version 5.15.8, a mismatch exists between how Astro normalizes request paths for routing/rendering and how the application’s middleware reads the path for validation checks. Astro internally applies decodeURI() to determine which route to render, while the middleware uses context.url.pathname without applying the same normalization (decodeURI). This discrepancy may allow attackers to reach protected routes using encoded path variants that pass routing but bypass validation checks. This issue has been patched in version 5.15.8.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-64765 https://cve.radiocsirt.org/vuln/ghsa-ggxq-hp9w-j794 <p><strong>Affected:</strong> npm: astro</p> <p>A mismatch exists between how Astro normalizes request paths for routing/rendering and how the application’s middleware reads the path for validation checks. Astro internally applies `decodeURI()` to determine which route to render, while the middleware uses `context.url.pathname` without applying the same normalization (decodeURI).</p> <p>This discrepancy may allow attackers to reach protected routes (e.g., /admin) using encoded path variants that pass routing but bypass validation checks.</p> <p>https://github.com/withastro/astro/blob/ebc4b1cde82c76076d5d673b5b70f94be2c066f3/packages/astro/src/vite-plugin-astro-server/request.ts#L40-L44</p> <p>```js /** The main logic to route dev server requests to pages in Astro. */ export async function handleRequest({ pipeline, routesList, controller, incomingRequest, incomingResponse, }: HandleRequest) { const { config, loader } = pipeline; const origin = `${loader.isHttps() ? &#39;https&#39; : &#39;http&#39;}://${ incomingRequest.headers[&#39;:authority&#39;] ?? incomingRequest.headers.host }`;</p> <p>const url = new URL(origin + incomingRequest.url); let pathname: string; if (config.trailingSlash === &#39;never&#39; &amp;&amp; !incomingRequest.url) { pathname = &#39;&#39;; } else { // We already have a middleware that checks if there&#39;s an incoming URL that has invalid URI, so it&#39;s safe // to not handle the error: packages/astro/src/vite-plugin-astro-server/base.ts pathname = decodeURI(url.pathname); // here this url…</p> <p><strong>Affected:</strong> npm: astro</p> <p>A mismatch exists between how Astro normalizes request paths for routing/rendering and how the application’s middleware reads the path for validation checks. Astro internally applies `decodeURI()` to determine which route to render, while the middleware uses `context.url.pathname` without applying the same normalization (decodeURI).</p> <p>This discrepancy may allow attackers to reach protected routes (e.g., /admin) using encoded path variants that pass routing but bypass validation checks.</p> <p>https://github.com/withastro/astro/blob/ebc4b1cde82c76076d5d673b5b70f94be2c066f3/packages/astro/src/vite-plugin-astro-server/request.ts#L40-L44</p> <p>```js /** The main logic to route dev server requests to pages in Astro. */ export async function handleRequest({ pipeline, routesList, controller, incomingRequest, incomingResponse, }: HandleRequest) { const { config, loader } = pipeline; const origin = `${loader.isHttps() ? &#39;https&#39; : &#39;http&#39;}://${ incomingRequest.headers[&#39;:authority&#39;] ?? incomingRequest.headers.host }`;</p> <p>const url = new URL(origin + incomingRequest.url); let pathname: string; if (config.trailingSlash === &#39;never&#39; &amp;&amp; !incomingRequest.url) { pathname = &#39;&#39;; } else { // We already have a middleware that checks if there&#39;s an incoming URL that has invalid URI, so it&#39;s safe // to not handle the error: packages/astro/src/vite-plugin-astro-server/base.ts pathname = decodeURI(url.pathname); // here this url…</p> https://cve.radiocsirt.org/vuln/ghsa-ggxq-hp9w-j794