Executive brief
Astro is a web framework used to build content-driven websites. In server-side rendering mode, it fails to validate the X-Forwarded-Host HTTP header, allowing attackers to inject malicious domain names that are reflected in application output. When a caching proxy is used, a single malicious request can poison the cache, affecting all subsequent visitors with fake URLs—potentially redirecting login credentials or manipulating page links to malicious sites.
Technical details
This is an unvalidated header reflection vulnerability (CWE-20, CWE-470) affecting Astro's SSR mode. When using Astro.url, the framework trusts the X-Forwarded-Host header without checking it against an allowlist of expected domains. An attacker can send a request with a crafted X-Forwarded-Host header while the legitimate Host header matches the application's domain; Astro will reflect the malicious value in responses. Attack vector is network-based with no authentication or user interaction required. Impact is heightened in cached environments where a single poisoned response persists across all users. The fix requires explicit configuration of allowed domains via security.allowedDomains and validates headers against this pattern; untrusted headers are ignored by default. Patched in version 5.14.2.
Affected products
- Astro Astro < 5.14.2
Timeline
- 2025-10-10: disclosed: Advisory published
- 2025-10-08: patched: Fix committed; patch released in version 5.14.2