CVE-2026-59731 affects the Astro web framework version 6.4.7. The vulnerability arises because authorization decisions are performed on a partially decoded URL path after the iterative URL decoder limit is reached. However, subsequent route matching performs an additional decodeURI() operation, which can resolve the request to a protected route that should not be accessible. This mismatch in decoding steps leads to improper authorization enforcement. The issue is addressed in version 6.4.8.

An attacker can potentially bypass authorization controls by exploiting the difference in URL decoding between the authorization check and the route matching, gaining unauthorized access to protected routes. The CVSS score of 8.2 (high severity) reflects the network attack vector, low complexity, no privileges required, no user interaction, and high confidentiality impact with limited integrity impact.

Upgrade to Astro version 6.4.8 or later, where this vulnerability has been fixed. No other mitigation guidance is provided or necessary as the fix addresses the root cause.