Cyber Resilience

CVE-2025-66202

Astro ≤ 5.15.8

Published
09 December 2025
Modified
10 December 2025
Patch / advisory
View advisory
CVSS Score v3.1 6.5
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
EPSS Score 0.0032 24th percentile
Risk Priority 50 floored blend · peak EPSS

Summary

CVE-2025-66202 is a medium-severity Use of Non-Canonical URL Paths for Authorization Decisions (CWE-647) vulnerability in Astro Astro. Its CVSS base score is 6.5 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 24th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

Astro is a web framework. Versions 5.15.7 and below have a double URL encoding bypass which allows any unauthenticated attacker to bypass path-based authentication checks in Astro middleware, granting unauthorized access to protected routes. While the original CVE-2025-64765 was fixed…

more

in v5.15.8, the fix is insufficient as it only decodes once. By using double-encoded URLs, attackers can still bypass authentication and access any route protected by middleware pathname checks. This issue is fixed in version 5.15.8.

CWE(s)
CWE-647

Related Threats

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2025-64525Same product: Astro Astro
CVE-2024-56140Same product: Astro Astro
CVE-2025-64765Same product: Astro Astro
CVE-2024-56159Same product: Astro Astro
CVE-2025-64757Same product: Astro Astro
CVE-2026-54298Same product: Astro Astro
CVE-2026-33769Same product: Astro Astro
CVE-2026-41067Same product: Astro Astro
CVE-2024-47885Same product: Astro Astro
CVE-2025-59837Same product: Astro Astro

Affected Assets

astro
astro
≤ 5.15.8

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

—

Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)
  • V2.2.1
  • V10.4.1

Mitigating Controls (NIST 800-53 r5) AI

AC-3 Access Enforcement good match

Proper enforcement of authorization decisions requires canonical URL normalization before policy evaluation, directly stopping non-canonical bypasses.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.AA-05 mostly match
prevents

Enforcing well-defined authorization policies prevents URL canonicalization bypasses when path handling is included in the implementation.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.29 Security testing in development and acceptance mostly match
finds

Security testing can discover non-canonical URL bypasses but does not itself implement the preventive control.

A.8.26 Application security requirements partial match
prevents

Defining application security requirements that mandate canonical URL handling and authorization checks mitigates the weakness at design time.

A.8.28 Secure coding partial match
prevents

Secure-coding standards that require URL canonicalization and safe path handling eliminate the root cause of the weakness.

A.8.3 Information access restriction partial match
prevents

Enforcing strict access-control rules on canonical resource identifiers directly prevents authorization bypass via non-canonical URLs.

References