CVE-2025-66202: 
JavaScript vulnerability analysis and mitigation

CVE-2025-66202 is an authentication bypass vulnerability in the Astro web framework caused by double URL encoding, classified as a bypass for the previously disclosed CVE-2025-64765. It affects all versions of the astro npm package prior to 5.15.8 and allows unauthenticated attackers to circumvent path-based middleware authentication checks by submitting double-encoded URLs (e.g., /%2561dmin instead of /%61dmin). The vulnerability was published on December 6, 2025, and carries a CVSS v3.1 base score of 6.5 (Medium) (GitHub Advisory, Feedly).

The root cause is a path normalization mismatch between Astro's internal routing logic and the middleware context exposed to developers (CWE-647: Use of Non-Canonical URL Paths for Authorization Decisions). Astro's routing engine applies decodeURI() to determine which route to render, but the fix for CVE-2025-64765 only decoded the pathname once — meaning a double-encoded path like /%2561dmin is decoded to /%61dmin by the first pass, which still does not match the literal string /admin checked by middleware using context.url.pathname. The second encoding layer (%25 → %) is never resolved before the middleware comparison, allowing the request to pass authentication checks while still being routed to the protected /admin page. The patch (commit 6f80081) addresses this by introducing a #createNormalizedUrl static method in RenderContext that applies decodeURI() to the pathname before exposing it to middleware context, and also updates request.ts to apply decodeURI() when constructing the URL passed to SSR (GitHub Advisory, Patch Commit).

Successful exploitation allows unauthenticated attackers to access routes protected by Astro middleware pathname checks, such as /admin, /api/internal, or any other route guarded by equality or prefix comparisons on context.url.pathname. This results in unauthorized disclosure of sensitive information and potential unauthorized modification of application state (low confidentiality and low integrity impact per CVSS). Availability is not directly affected, but exposure of administrative interfaces could enable further compromise depending on the application's functionality (GitHub Advisory, Feedly).

No public proof-of-concept exploit code has been identified, and there is no evidence of in-the-wild exploitation at this time (Feedly). The vulnerability requires no authentication, no user interaction, and is exploitable over the network with low attack complexity, making it straightforward to attempt once the technique is known. The EPSS score is approximately 0.174%, indicating a currently low probability of exploitation in the near term. CVE-2025-66202 is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Reconnaissance: Identify Astro-based web applications running versions prior to 5.15.8 using HTTP response headers, package.json exposure, or technology fingerprinting tools (e.g., Wappalyzer, Shodan).
2. Identify protected routes: Probe the application for routes that redirect unauthenticated users (e.g., /admin, /api/internal) by sending normal requests and observing 302 redirects.
3. Craft double-encoded URL: Construct a double-encoded variant of the protected path. For example, to access /admin, encode a as %61 (single encoding: /%61dmin), then encode the % as %25 to produce the double-encoded form /%2561dmin.
4. Send bypass request: Issue an HTTP GET request to the double-encoded path: GET /%2561dmin HTTP/1.1 targeting the vulnerable Astro server. The middleware receives /%61dmin as context.url.pathname (after one decode), which does not match the literal /admin check, so authentication is bypassed.
5. Access protected content: Astro's routing engine performs a second decode, resolving /%61dmin to /admin and serving the protected page content to the unauthenticated attacker (GitHub Advisory, Patch Commit).

• Network: HTTP requests containing double-encoded path segments (e.g., /%25XX patterns) targeting known protected routes such as /admin or /api/internal; unexpected 200 responses to requests with encoded paths that would normally return 302 redirects.
• Logs: Web server or application access logs showing requests with %25-prefixed hex sequences in the URL path (e.g., GET /%2561dmin, GET /%2570rofile); absence of authentication headers in requests that successfully reach protected endpoints.
• Application Behavior: Successful access to admin panels or internal API endpoints from unauthenticated sessions; session logs showing privileged page content served without a corresponding login event.

Upgrade the astro npm package to version 5.15.8 or later, which normalizes URL-encoded pathnames before exposing them to middleware context, ensuring context.url.pathname always reflects the fully decoded canonical path (GitHub Advisory, Patch Commit). As a temporary workaround, middleware authors can manually apply decodeURI() (or iterative decoding) to context.url.pathname before performing authorization comparisons. Additionally, consider rejecting requests containing residual %XX sequences in the pathname after a single decode pass (returning HTTP 400), as suggested by the reporter (GitHub Advisory).

The vulnerability was reported by security researcher zomaxsec and published as a GitHub Security Advisory on December 6, 2025, by Astro maintainer matthewp. A Medium article by Josh Beck (published later) described a lab walkthrough of the double URL encoding bypass, indicating some community interest in the technique (Medium). Red Hat also tracked the vulnerability, suggesting broader ecosystem awareness (Red Hat).