Description
A bug in Astro’s CSRF-protection middleware allows requests to bypass CSRF checks.
Recommendation
Update the astro package to the latest compatible version. Followings are version details:
- Affected version(s): < 4.16.17
- Patched version(s): 4.16.17
References
Related Issues
- Astro Cloudflare adapter has Stored Cross-site Scripting vulnerability in /_image endpoint - CVE-2025-65019
- Astro development server error page is vulnerable to reflected Cross-site Scripting - CVE-2025-64745
- Astro allows unauthorized third-party images in _image endpoint - CVE-2025-55303
- Astros's duplicate trailing slash feature leads to an open redirection security issue - CVE-2025-54793
- Tags:
- npm
- astro
Anything's wrong? Let us know Last updated on November 27, 2025