CVE-2025-64525

nvd nist nuclei

Published: Nov 13, 2025Modified: Jun 17, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Exploitability: 3.9 / Impact: 2.5

Source: security-advisories@github.com (Secondary)

Description

Astro is a web framework. In Astro versions 2.16.0 up to but excluding 5.15.5 which utilizeon-demand rendering, request headers `x-forwarded-proto` and `x-forwarded-port` are insecurely used, without sanitization, to build the URL. This has several consequences, the most important of which are: middleware-based protected route bypass (only via `x-forwarded-proto`), DoS via cache poisoning (if a CDN is present), SSRF (only via `x-forwarded-proto`), URL pollution (potential SXSS, if a CDN is present), and WAF bypass. Version 5.15.5 contains a patch.

Affected (1)

Products: Astro: Astro

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Astro Astro	From 2.16.0 to 5.15.5

Related CWEs

Server-Side Request Forgery (SSRF)

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

References (4)

https://github.com/withastro/astro/blob/970ac0f51172e1e6bff4440516a851e725ac3097/packages/astro/src/core/app/node.ts#L121

Source: security-advisories@github.com

Product

https://github.com/withastro/astro/blob/970ac0f51172e1e6bff4440516a851e725ac3097/packages/astro/src/core/app/node.ts#L97

Source: security-advisories@github.com

Product

https://github.com/withastro/astro/commit/dafbb1ba29912099c4faff1440033edc768af8b4

Source: security-advisories@github.com

Patch

https://github.com/withastro/astro/security/advisories/GHSA-hr2q-hp5q-x767

Source: security-advisories@github.com

ExploitThird Party Advisory

Timeline

No history available yet.