Description
A bug in Astro’s CSRF-protection middleware allows requests to bypass CSRF checks.
Recommendation
Update the astro package to the latest compatible version. Followings are version details:
- Affected version(s): < 4.16.17
- Patched version(s): 4.16.17
References
Related Issues
- Cross-site Scripting (XSS) in serialize-javascript - CVE-2024-11831
- Astro has an Authentication Bypass via Double URL Encoding, a bypass for CVE-2025-64765 - CVE-2025-66202
- Astro Cloudflare adapter has Stored Cross-site Scripting vulnerability in /_image endpoint - CVE-2025-65019
- Astro's middleware authentication checks based on url.pathname can be bypassed via url encoded values - CVE-2025-64765
- Tags:
- npm
- astro
Anything's wrong? Let us know Last updated on November 27, 2025