Is CVE-2026-59731 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-59731?

CVE-2026-59731 has a CVSS v3 severity of HIGH (8.2).

Back

CVE-2026-59731

Description

Astro is a web framework for content-driven websites. Version 6.4.7 performs authorization decisions on a partially decoded pathname after reaching the iterative URL decoder limit, while later rewrite route matching performs an additional decodeURI() operation and can resolve the request to a protected route. This issue is fixed in version 6.4.8.