Astro vulnerable to URL manipulation via headers, leading to middleware and CVE-2025-61925 bypass

Description

In impacted versions of Astro using on-demand rendering, request headers x-forwarded-proto and x-forwarded-port are insecurely used, without sanitization, to build the URL.

Recommendation

Update the astro package to the latest compatible version. Followings are version details:

• Affected version(s): >= 2.16.0, < 5.15.5
• Patched version(s): 5.15.5

References

• GHSA-hr2q-hp5q-x767
• CVE-2025-64525
• CWE-918
• CAPEC-310
• OWASP 2021-A10
• OWASP 2021-A6

Related Issues

• Astro has an Authentication Bypass via Double URL Encoding, a bypass for CVE-2025-64765 - CVE-2025-66202
• Astro's middleware authentication checks based on url.pathname can be bypassed via url encoded values - CVE-2025-64765
• Astro development server error page is vulnerable to reflected Cross-site Scripting - CVE-2025-64745
• Astro allows unauthorized third-party images in _image endpoint - CVE-2025-55303

Tags:

npm

astro