# CVE-2026-59731

## Summary

- **CVE ID:** CVE-2026-59731
- **Severity:** HIGH
- **CVSS Score:** 8.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N)
- **CWE:** CWE-647
- **Published:** Jul 8, 2026
- **Last Modified:** Jul 9, 2026

## Description

Astro is a web framework for content-driven websites. Version 6.4.7 performs authorization decisions on a partially decoded pathname after reaching the iterative URL decoder limit, while later rewrite route matching performs an additional decodeURI() operation and can resolve the request to a protected route. This issue is fixed in version 6.4.8.

## Affected Products

- withastro — astro (>= 6.4.7, < 6.4.8)

## References

- [CNA](https://github.com/withastro/astro/security/advisories/GHSA-vj59-8hwv-xxmv)
- [CNA](https://github.com/withastro/astro/pull/17109)
- [CNA](https://github.com/withastro/astro/commit/27c80ea92248993e5fce94b2c26d87d611ab6785)
- [CNA](https://github.com/withastro/astro/releases/tag/astro@6.4.8)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.47%
- **EPSS Percentile:** 38.9

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-10._