GHSA-vj59-8hwv-xxmv: Astro: Authorization Bypass via Decode Iteration Limit and Rewrite Path Canonicalization Mismatch

Astro 6.4.7 Authorization Bypass via Decode Iteration Limit and Rewrite Path Canonicalization Mismatch Summary Astro 6.4.7 appears to reintroduce a middleware authorization bypass pattern when a request path is encoded more deeply than the newly introduced iterative URL decoder's maximum decoding depth. The issue occurs because Astro performs authorization decisions on a partially decoded pathname after reaching a decoding iteration cap, while later route matching logic performs an additional decodeURI() operation and resolves the request to a protected route. As a result, middleware and route matching may operate on different pathname representations, enabling authorization bypasses under specific application patterns. Potential CWE: CWE-647 – Use of Non-Canonical URL Paths for Authorization Decisions Vulnerable Pattern Middleware authorization sees: /%61dmin Later rewrite route matching sees: /admin This discrepancy allows a request that bypasses middleware checks to subsequently resolve to a protected route. Root Cause Iterative Decoding Logic PR #16967 introduced iterative URI decoding: let iterations = 0; while (decoded !== pathname && iterations < 10) { pathname = decoded; try { decoded = decodeURI(pathname); } catch { // decodeURI can fail when a decoded literal '%' forms an // invalid sequence with adjacent characters. break; } iterations++; } return decoded; The intent was to ensure middleware receives a fully decoded canonical pathname. However, once the iteration cap is reached, Astro returns the partially decoded value instead of rejecting the request. Rewrite Route Matching Later, Astro performs another decode during route matching: const decodedPathname = decodeURI(pathname); Consequently: Middleware pathname: /%61dmin Route matcher: /admin This creates a canonicalization mismatch between authorization logic and routing logic. Proof of Concept Middleware import { defineMiddleware } from 'astro:middleware'; export const on