Astro · Astro · CVE-2026-59731
**Name of the Vulnerable Software and Affected Versions**
Astro version 6.4.7
**Description**
Astro performs authorization decisions on a partially decoded pathname after reaching the iterative URL decoder limit. Subsequently, rewrite route matching performs an additional `decodeURI()` operation, which can allow a request to resolve to a protected route.
**Recommendations**
Update to version 6.4.8.