AIKIDO-2026-219768

TL;DR

Astro derives the routing and middleware pathname for domain-based i18n requests without applying the duplicate-slash collapsing and over-encoding validation that are used on the standard request path. An unauthenticated attacker can send a request with duplicate leading slashes or multi-level percent-encoding to a domain-mapped host so that middleware or edge authorization evaluates a different path than the one that is actually routed and rendered. On deployments that rely on path-based authorization this allows those checks to be bypassed and protected routes to be reached. The fix normalizes the public pathname consistently and rejects over-encoded paths before routing runs.