# CVE-2025-64745: Astro development server reflected XSS in error page

Source: https://junglewise.ai/threats/cve-2025-64745-astro-development-server-reflected-xss-in-error-page  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-11-13. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2025-64745 · Severity: low · CVSS 3.1 · Published 2025-11-13

Astro is a web framework used to build fast websites and web applications. The development server's error page contains a reflected cross-site scripting (XSS) vulnerability that allows attackers to inject malicious code through specially crafted URLs. This could enable account takeover or session hijacking of developers who click on malicious links, particularly in social engineering attacks or when dev servers are exposed to the internet.

Technologies: [Astro](https://junglewise.ai/threats/technologies/astro-astro), [astro (npm)](https://junglewise.ai/threats/technologies/astro). Vendors: [Astro](https://junglewise.ai/threats/vendors/astro), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2025-64745 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-64745 being exploited in the wild.

**How severe is CVE-2025-64745?** Low severity, with a CVSS score of 3.1, published 13 November 2025.

**Which products and versions are affected?** astro (npm) SEMVER:introduced=5.2.0,fixed=5.15.6.

**Is there a fix for CVE-2025-64745?** Yes. astro (npm): upgrade to 5.15.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-64745 attacked?** It is attacked with local access.

**Am I affected by CVE-2025-64745?** Check whether you run Astro or astro (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- astro (npm): upgrade to 5.15.6 or later

  ```sh
  npm install astro@5.15.6
  ```


## Technical details

A reflected XSS vulnerability exists in Astro's development server error page template (packages/astro/src/template/4xx.ts) when the trailingSlash configuration is set to 'always' or 'never'. The root cause is insufficient output encoding: the `corrected` variable (derived from the user-controlled pathname parameter) is interpolated directly into HTML without escaping, even though the pathname variable is escaped elsewhere in the same file. An attacker crafts a URL with JavaScript payload that executes in the victim's browser when the dev server returns a 404 page. This only affects the development server (not production builds) and requires user interaction (clicking a link). Patches are available in Astro >= 5.15.6.

## Affected products

- Astro Astro >= 5.2.0, < 5.15.6

## Identifiers

- CVE-2025-64745
- GHSA-w2vj-39qv-7vh7

## Timeline

- 2025-11-13: disclosed
- 2025-11-13: patched: Fixed in version 5.15.6

## References

- [https://github.com/withastro/astro/security/advisories/GHSA-w2vj-39qv-7vh7](https://github.com/withastro/astro/security/advisories/GHSA-w2vj-39qv-7vh7)

## Related threats

- [Astro case-sensitive path bypass in image endpoint](https://junglewise.ai/threats/cve-2026-126364-astro-is-a-web-framework-for-content-driven-websites-from-5-14-3)
- [Astro HTML injection in dynamic element rendering](https://junglewise.ai/threats/cve-2026-126361-astro-is-a-web-framework-for-content-driven-websites-prior-to-7)
- [Astro HTML injection in script and style element rendering](https://junglewise.ai/threats/cve-2026-114128-astro-is-a-web-framework-for-content-driven-websites-prior-to-7)
- [Astro CSS injection in View Transition animation values](https://junglewise.ai/threats/cve-2026-114127-astro-is-a-web-framework-for-content-driven-websites-from-7-1-0)
- [Astro remote code execution via AVIF image processing](https://junglewise.ai/threats/astro-remote-code-execution-via-avif-image-processing-6b99ffe8)