CVE-2025-64525: Astro URL manipulation via unsanitized headers

CVE-2025-64525 · Severity: medium · CVSS 6.5 · Published 2025-11-13

Astro is a web framework used to build server-rendered web applications. The framework insecurely processes HTTP headers (x-forwarded-proto and x-forwarded-port) without sanitization, allowing attackers to manipulate request URLs. An attacker can bypass authentication middleware, trigger cache poisoning attacks on CDN-backed sites, perform server-side request forgery, or poison WAF rules—all without authentication.

Technologies: Astro, astro (npm). Vendors: Astro, npm.

Quick answers

Is CVE-2025-64525 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-64525 being exploited in the wild.
How severe is CVE-2025-64525?
Medium severity, with a CVSS score of 6.5, published 13 November 2025.
Which products and versions are affected?
astro (npm) SEMVER:introduced=2.16.0,fixed=5.15.5.
Is there a fix for CVE-2025-64525?
Yes. astro (npm): upgrade to 5.15.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-64525 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2025-64525?
Check whether you run Astro or astro (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • astro (npm): upgrade to 5.15.5 or later
    npm install astro@5.15.5

Technical details

The vulnerability is an improper input validation flaw in Astro's createRequest() function (packages/astro/src/core/app/node.ts, lines 97 and 121), which directly uses x-forwarded-proto and x-forwarded-port headers without sanitization to construct request URLs via the URL constructor. An unauthenticated attacker on the network can inject malicious header values to rewrite the entire URL including protocol, host, port, and path; for example, setting x-forwarded-proto to "https://malicious-url.com/?tank=" causes the URL to be constructed as "https://malicious-url.com/?tank=://localhost/ssr". This enables multiple attack vectors: path-based middleware checks can be bypassed by manipulating the pathname (e.g., "admin" vs "/admin"), SSRF attacks are possible if the constructed URL is used in downstream API calls, and cache-poisoning DoS attacks can be triggered on CDN-backed applications by forcing 404 responses to be cached. The vulnerability affects all on-demand rendered pages (all non-static routes), and patches are available in Astro 5.15.5 and later.

Affected products

  • Astro Astro <= 2.16.0

Identifiers

  • CVE-2025-64525
  • GHSA-hr2q-hp5q-x767

Timeline

  • 2025-11-13: disclosed
  • 2025-11-13: patched: patched in version >= 5.15.5

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.