Astro vulnerable to URL manipulation via headers, leading to middleware and CVE-2025-61925 bypass

Description

In impacted versions of Astro using on-demand rendering, request headers x-forwarded-proto and x-forwarded-port are insecurely used, without sanitization, to build the URL.

Recommendation

Update the astro package to the latest compatible version. Followings are version details:

• Affected version(s): >= 2.16.0, < 5.15.5
• Patched version(s): 5.15.5

References

• GHSA-hr2q-hp5q-x767
• CVE-2025-64525
• CWE-918
• CAPEC-310
• OWASP 2021-A10
• OWASP 2021-A6

Related Issues

• Remix and React Router allow URL manipulation via Host / X-Forwarded-Host headers - CVE-2025-31137
• Astro's middleware authentication checks based on url.pathname can be bypassed via url encoded values - CVE-2025-64765
• Astro has an Authentication Bypass via Double URL Encoding, a bypass for CVE-2025-64765 - CVE-2025-66202
• webpack buildHttp: allowedUris allow-list bypass via URL userinfo (@) leading to build-time SSRF behavior - CVE-2025-68458

Tags:

npm

astro