@a1st/aix (>=0.0.3, <=0.6.0), @a1st/aix-core (>=0.2.0, <=0.6.0) +20 more potentially affected by CVE-2026-59731 via astro (>=6.0.0-beta.1, <=6.4.6)

astro NPM version =6.0.0-beta.1, =0.0.3, =0.2.0, =1.11.1, =2.7.0, =0.3.0, =0.22.0, =1.4.1, =0.19.0, =0.19.0, =1.10.0, =1.12.1 - astro-crush 1.0.0 and more Source cves: CVE-2026-59731 Source advisory: SNYK:JS-ASTRO-17901336...

CVE-2026-59731

Astro 6.4.7 contains an authorization bypass due to improper handling of partially decoded pathnames after the iterative URL decoder limit, with an additional decodeURI() during rewrite route matching that can lead to accessing a protected route. The issue affects 6.4.7 and is fixed in 6.4.8. The...