# CVE-2025-61925: Astro X-Forwarded-Host header injection

Source: https://junglewise.ai/threats/cve-2025-61925-astro-x-forwarded-host-header-injection  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-10-10. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2025-61925 · Severity: medium · CVSS 6.5 · Published 2025-10-10

Astro is a web framework used to build content-driven websites. In server-side rendering mode, it fails to validate the X-Forwarded-Host HTTP header, allowing attackers to inject malicious domain names that are reflected in application output. When a caching proxy is used, a single malicious request can poison the cache, affecting all subsequent visitors with fake URLs—potentially redirecting login credentials or manipulating page links to malicious sites.

Technologies: [Astro](https://junglewise.ai/threats/technologies/astro-astro), [astro (npm)](https://junglewise.ai/threats/technologies/astro). Vendors: [Astro](https://junglewise.ai/threats/vendors/astro), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2025-61925 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-61925 being exploited in the wild.

**How severe is CVE-2025-61925?** Medium severity, with a CVSS score of 6.5, published 10 October 2025.

**Which products and versions are affected?** astro (npm) SEMVER:introduced=0,fixed=5.14.3.

**Is there a fix for CVE-2025-61925?** Yes. astro (npm): upgrade to 5.14.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-61925 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2025-61925?** Check whether you run Astro or astro (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- astro (npm): upgrade to 5.14.3 or later

  ```sh
  npm install astro@5.14.3
  ```


## Technical details

This is an unvalidated header reflection vulnerability (CWE-20, CWE-470) affecting Astro's SSR mode. When using Astro.url, the framework trusts the X-Forwarded-Host header without checking it against an allowlist of expected domains. An attacker can send a request with a crafted X-Forwarded-Host header while the legitimate Host header matches the application's domain; Astro will reflect the malicious value in responses. Attack vector is network-based with no authentication or user interaction required. Impact is heightened in cached environments where a single poisoned response persists across all users. The fix requires explicit configuration of allowed domains via security.allowedDomains and validates headers against this pattern; untrusted headers are ignored by default. Patched in version 5.14.2.

## Affected products

- Astro Astro < 5.14.2

## Identifiers

- CVE-2025-61925
- GHSA-5ff5-9fcw-vg88

## Timeline

- 2025-10-10: disclosed: Advisory published
- 2025-10-08: patched: Fix committed; patch released in version 5.14.2

## References

- [https://github.com/withastro/astro/security/advisories/GHSA-5ff5-9fcw-vg88](https://github.com/withastro/astro/security/advisories/GHSA-5ff5-9fcw-vg88)
- [https://github.com/withastro/astro/commit/6ee63bfac4856f21b4d4633021b3d2ee059e553f](https://github.com/withastro/astro/commit/6ee63bfac4856f21b4d4633021b3d2ee059e553f)
- [https://github.com/Chisnet/minimal_dynamic_astro_server](https://github.com/Chisnet/minimal_dynamic_astro_server)
- [https://github.com/withastro/astro](https://github.com/withastro/astro)

## Related threats

- [Astro case-sensitive path bypass in image endpoint](https://junglewise.ai/threats/cve-2026-126364-astro-is-a-web-framework-for-content-driven-websites-from-5-14-3)
- [Astro HTML injection in dynamic element rendering](https://junglewise.ai/threats/cve-2026-126361-astro-is-a-web-framework-for-content-driven-websites-prior-to-7)
- [Astro HTML injection in script and style element rendering](https://junglewise.ai/threats/cve-2026-114128-astro-is-a-web-framework-for-content-driven-websites-prior-to-7)
- [Astro CSS injection in View Transition animation values](https://junglewise.ai/threats/cve-2026-114127-astro-is-a-web-framework-for-content-driven-websites-from-7-1-0)
- [Astro remote code execution via AVIF image processing](https://junglewise.ai/threats/astro-remote-code-execution-via-avif-image-processing-6b99ffe8)