Description
A bug in Astro’s CSRF-protection middleware allows requests to bypass CSRF checks.
Recommendation
Update the astro package to the latest compatible version. Followings are version details:
- Affected version(s): < 4.16.17
- Patched version(s): 4.16.17
References
Related Issues
- Astro vulnerable to URL manipulation via headers, leading to middleware and CVE-2025-61925 bypass - CVE-2025-64525
- DOM Clobbering Gadget found in astro's client-side router that leads to XSS - CVE-2024-47885
- Astro's server source code is exposed to the public if sourcemaps are enabled - CVE-2024-56159
- Astro's bypass of image proxy domain validation leads to SSRF and potential XSS - CVE-2025-59837
- Tags:
- npm
- astro
Anything's wrong? Let us know Last updated on November 27, 2025