Is CVE-2025-64757 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-64757 being exploited in the wild.

How severe is CVE-2025-64757?

Low severity, with a CVSS score of 3.5, published 19 November 2025.

Which products and versions are affected?

astro (npm) SEMVER:introduced=0,fixed=5.14.3.

Is there a fix for CVE-2025-64757?

Yes. astro (npm): upgrade to 5.14.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-64757 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2025-64757?

Check whether you run Astro or astro (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-64757: Astro Development Server path traversal in image endpoint

CVE-2025-64757 · Severity: low · CVSS 3.5 · Published 2025-11-19

Astro is a popular web framework with a built-in development server for testing sites locally. The development server's image optimization feature contains a path traversal vulnerability that allows an attacker running on the same network to read any image file accessible to the Node.js process, potentially exposing sensitive system files or application data.

Technologies: Astro, astro (npm). Vendors: Astro, npm.

Quick answers

Is CVE-2025-64757 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-64757 being exploited in the wild.
How severe is CVE-2025-64757?: Low severity, with a CVSS score of 3.5, published 19 November 2025.
Which products and versions are affected?: astro (npm) SEMVER:introduced=0,fixed=5.14.3.
Is there a fix for CVE-2025-64757?: Yes. astro (npm): upgrade to 5.14.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-64757 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2025-64757?: Check whether you run Astro or astro (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

astro (npm): upgrade to 5.14.3 or later
```
npm install astro@5.14.3
```

Technical details

The vulnerability is a path traversal flaw (CWE-22) in the Node.js image endpoint handler (packages/astro/src/assets/endpoint/node.ts) used during development mode. The endpoint accepts an href parameter without proper validation in development mode, allowing absolute file paths to be specified. An attacker with network access to the development server (typically running on localhost:4321) can craft HTTP GET requests to the /_image endpoint with absolute paths, bypassing the path restrictions that exist in the production code path. The attack requires the development server to be running and the target image files to be readable by the Node.js process. Exploitation results in arbitrary local file read, with the attacker receiving the image contents in the HTTP response. The vulnerability is fixed in Astro version 5.14.3 and later.

Affected products

Astro Astro < 5.14.3

Identifiers

CVE-2025-64757
GHSA-x3h8-62x9-952g

Timeline

2025-11-19: disclosed
2025-11-19: patched: Fixed in version 5.14.3

References

https://github.com/withastro/astro/security/advisories/GHSA-x3h8-62x9-952g

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.