Is CVE-2025-61925 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-61925 being exploited in the wild.

How severe is CVE-2025-61925?

Medium severity, with a CVSS score of 6.5, published 10 October 2025.

Which products and versions are affected?

astro (npm) SEMVER:introduced=0,fixed=5.14.3.

Is there a fix for CVE-2025-61925?

Yes. astro (npm): upgrade to 5.14.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-61925 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2025-61925?

Check whether you run Astro or astro (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-61925: Astro X-Forwarded-Host header injection

CVE-2025-61925 · Severity: medium · CVSS 6.5 · Published 2025-10-10

Astro is a web framework used to build content-driven websites. In server-side rendering mode, it fails to validate the X-Forwarded-Host HTTP header, allowing attackers to inject malicious domain names that are reflected in application output. When a caching proxy is used, a single malicious request can poison the cache, affecting all subsequent visitors with fake URLs—potentially redirecting login credentials or manipulating page links to malicious sites.

Technologies: Astro, astro (npm). Vendors: Astro, npm.

Quick answers

Is CVE-2025-61925 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-61925 being exploited in the wild.
How severe is CVE-2025-61925?: Medium severity, with a CVSS score of 6.5, published 10 October 2025.
Which products and versions are affected?: astro (npm) SEMVER:introduced=0,fixed=5.14.3.
Is there a fix for CVE-2025-61925?: Yes. astro (npm): upgrade to 5.14.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-61925 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2025-61925?: Check whether you run Astro or astro (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

astro (npm): upgrade to 5.14.3 or later
```
npm install astro@5.14.3
```

Technical details

This is an unvalidated header reflection vulnerability (CWE-20, CWE-470) affecting Astro's SSR mode. When using Astro.url, the framework trusts the X-Forwarded-Host header without checking it against an allowlist of expected domains. An attacker can send a request with a crafted X-Forwarded-Host header while the legitimate Host header matches the application's domain; Astro will reflect the malicious value in responses. Attack vector is network-based with no authentication or user interaction required. Impact is heightened in cached environments where a single poisoned response persists across all users. The fix requires explicit configuration of allowed domains via security.allowedDomains and validates headers against this pattern; untrusted headers are ignored by default. Patched in version 5.14.2.

Affected products

Astro Astro < 5.14.2

Identifiers

CVE-2025-61925
GHSA-5ff5-9fcw-vg88

Timeline

2025-10-10: disclosed: Advisory published
2025-10-08: patched: Fix committed; patch released in version 5.14.2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.