Authentication bypass via double-encoded path mismatch

Authentication bypass in Astro before 5.15.8 allows remote attackers to access routes protected by pathname-based middleware checks. Astro normalizes a request path for routing but exposes a pathname decoded only once to middleware, so a double-encoded path resolves to a protected route after passing a nonmatching authorization comparison. The application must use Astro middleware to authorize specific pathnames; exploitation is unauthenticated and can expose or alter resources reachable through those routes.