CVE-2025-64525

Astro is a web framework. In Astro versions 2.16.0 up to but excluding 5.15.5 which utilizeon-demand rendering, request headers `x-forwarded-proto` and `x-forwarded-port` are insecurely used, without sanitization, to build the URL. This has several consequences, the most important of which are: middleware-based protected route bypass (only via `x-forwarded-proto`), DoS via cache poisoning (if a CDN is present), SSRF (only via `x-forwarded-proto`), URL pollution (potential SXSS, if a CDN is present), and WAF bypass. Version 5.15.5 contains a patch.

Published Nov 14, 2025

https://github.com/advisories/GHSA-hr2q-hp5q-x767

CVSS ScoreMedium

6.5

Ecosystem	Package	Version

Ecosystem	Package	Version

Vulnerabilities

CVE-2025-64525

Astro is a web framework. In Astro versions 2.16.0 up to but excluding 5.15.5 which utilizeon-demand rendering, request headers `x-forwarded-proto` and `x-forwarded-port` are insecurely used, without sanitization, to build the URL. This has several consequences, the most important of which are: middleware-based protected route bypass (only via `x-forwarded-proto`), DoS via cache poisoning (if a CDN is present), SSRF (only via `x-forwarded-proto`), URL pollution (potential SXSS, if a CDN is present), and WAF bypass. Version 5.15.5 contains a patch.

Published Nov 14, 2025

https://github.com/advisories/GHSA-hr2q-hp5q-x767

CVSS ScoreMedium

6.5


npm	astro	3.0.0-beta.0
npm	astro	3.0.0-beta.1
npm	astro	3.0.0-beta.2
npm	astro	3.0.0-beta.3
npm	astro	3.0.0-beta.4
npm	astro	3.0.0-rc.10
npm	astro	3.0.0-rc.11
npm	astro	3.0.0-rc.5
npm	astro	3.0.0-rc.6
npm	astro	3.0.0-rc.7
npm	astro	3.0.0-rc.8
npm	astro	3.0.0-rc.9
npm	astro	3.0.0
npm	astro	3.0.10
npm	astro	3.0.11
npm	astro	3.0.12
npm	astro	3.0.13
npm	astro	3.0.1
npm	astro	3.0.2
npm	astro	3.0.3
npm	astro	3.0.4
npm	astro	3.0.5
npm	astro	3.0.6
npm	astro	3.0.7
npm	astro	3.0.8
npm	astro	3.0.9
npm	astro	3.1.0
npm	astro	3.1.1
npm	astro	3.1.2
npm	astro	3.1.3
npm	astro	3.1.4
npm	astro	3.2.0
npm	astro	3.2.1
npm	astro	3.2.2
npm	astro	3.2.3
npm	astro	3.2.4
npm	astro	3.3.0
npm	astro	3.3.1
npm	astro	3.3.2
npm	astro	3.3.3
npm	astro	3.3.4
npm	astro	3.4.0
npm	astro	3.4.1
npm	astro	3.4.2
npm	astro	3.4.3
npm	astro	3.4.4
npm	astro	3.5.0
npm	astro	3.5.1
npm	astro	3.5.2
npm	astro	3.5.3

Ecosystem	Package	Version


npm	astro	3.0.0-beta.0
npm	astro	3.0.0-beta.1
npm	astro	3.0.0-beta.2
npm	astro	3.0.0-beta.3
npm	astro	3.0.0-beta.4
npm	astro	3.0.0-rc.10
npm	astro	3.0.0-rc.11
npm	astro	3.0.0-rc.5
npm	astro	3.0.0-rc.6
npm	astro	3.0.0-rc.7
npm	astro	3.0.0-rc.8
npm	astro	3.0.0-rc.9
npm	astro	3.0.0
npm	astro	3.0.10
npm	astro	3.0.11
npm	astro	3.0.12
npm	astro	3.0.13
npm	astro	3.0.1
npm	astro	3.0.2
npm	astro	3.0.3
npm	astro	3.0.4
npm	astro	3.0.5
npm	astro	3.0.6
npm	astro	3.0.7
npm	astro	3.0.8
npm	astro	3.0.9
npm	astro	3.1.0
npm	astro	3.1.1
npm	astro	3.1.2
npm	astro	3.1.3
npm	astro	3.1.4
npm	astro	3.2.0
npm	astro	3.2.1
npm	astro	3.2.2
npm	astro	3.2.3
npm	astro	3.2.4
npm	astro	3.3.0
npm	astro	3.3.1
npm	astro	3.3.2
npm	astro	3.3.3
npm	astro	3.3.4
npm	astro	3.4.0
npm	astro	3.4.1
npm	astro	3.4.2
npm	astro	3.4.3
npm	astro	3.4.4
npm	astro	3.5.0
npm	astro	3.5.1
npm	astro	3.5.2
npm	astro	3.5.3

Find vulnerabilities. Fix fast with AI.

CVE-2025-64525

CVE-2025-64525