Is CVE-2025-64745 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-64745 being exploited in the wild.

How severe is CVE-2025-64745?

Low severity, with a CVSS score of 3.1, published 13 November 2025.

Which products and versions are affected?

astro (npm) SEMVER:introduced=5.2.0,fixed=5.15.6.

Is there a fix for CVE-2025-64745?

Yes. astro (npm): upgrade to 5.15.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-64745 attacked?

It is attacked with local access.

Am I affected by CVE-2025-64745?

Check whether you run Astro or astro (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-64745: Astro development server reflected XSS in error page

CVE-2025-64745 · Severity: low · CVSS 3.1 · Published 2025-11-13

Astro is a web framework used to build fast websites and web applications. The development server's error page contains a reflected cross-site scripting (XSS) vulnerability that allows attackers to inject malicious code through specially crafted URLs. This could enable account takeover or session hijacking of developers who click on malicious links, particularly in social engineering attacks or when dev servers are exposed to the internet.

Technologies: Astro, astro (npm). Vendors: Astro, npm.

Quick answers

Is CVE-2025-64745 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-64745 being exploited in the wild.
How severe is CVE-2025-64745?: Low severity, with a CVSS score of 3.1, published 13 November 2025.
Which products and versions are affected?: astro (npm) SEMVER:introduced=5.2.0,fixed=5.15.6.
Is there a fix for CVE-2025-64745?: Yes. astro (npm): upgrade to 5.15.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-64745 attacked?: It is attacked with local access.
Am I affected by CVE-2025-64745?: Check whether you run Astro or astro (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

astro (npm): upgrade to 5.15.6 or later
```
npm install astro@5.15.6
```

Technical details

A reflected XSS vulnerability exists in Astro's development server error page template (packages/astro/src/template/4xx.ts) when the trailingSlash configuration is set to 'always' or 'never'. The root cause is insufficient output encoding: the `corrected` variable (derived from the user-controlled pathname parameter) is interpolated directly into HTML without escaping, even though the pathname variable is escaped elsewhere in the same file. An attacker crafts a URL with JavaScript payload that executes in the victim's browser when the dev server returns a 404 page. This only affects the development server (not production builds) and requires user interaction (clicking a link). Patches are available in Astro >= 5.15.6.

Affected products

Astro Astro >= 5.2.0, < 5.15.6

Identifiers

CVE-2025-64745
GHSA-w2vj-39qv-7vh7

Timeline

2025-11-13: disclosed
2025-11-13: patched: Fixed in version 5.15.6

References

https://github.com/withastro/astro/security/advisories/GHSA-w2vj-39qv-7vh7

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.