Astro Cloudflare adapter has Stored Cross-site Scripting vulnerability in /_image endpoint

Description

Summary
A Cross-Site Scripting (XSS) vulnerability exists in Astro when using the @astrojs/cloudflare adapter with output: 'server'. The built-in image optimization endpoint (/_image) uses isRemoteAllowed() from Astro’s internal helpers, which unconditionally allows data: URLs.

Recommendation

Update the astro package to the latest compatible version. Followings are version details:

• Affected version(s): < 5.15.9
• Patched version(s): 5.15.9

References

• GHSA-fvmw-cj7j-j39q
• CVE-2025-65019
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Signal K Server Vulnerable to Unauthenticated Information Disclosure via Exposed Endpoints - CVE-2025-68273
• Astro has an Authentication Bypass via Double URL Encoding, a bypass for CVE-2025-64765 - CVE-2025-66202
• Astro's middleware authentication checks based on url.pathname can be bypassed via url encoded values - CVE-2025-64765
• Astro development server error page is vulnerable to reflected Cross-site Scripting - CVE-2025-64745

Tags:

npm

astro