# CVE-2025-64757: Astro Development Server path traversal in image endpoint

Source: https://junglewise.ai/threats/cve-2025-64757-astro-development-server-path-traversal-in-image-endpoint  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-11-19. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2025-64757 · Severity: low · CVSS 3.5 · Published 2025-11-19

Astro is a popular web framework with a built-in development server for testing sites locally. The development server's image optimization feature contains a path traversal vulnerability that allows an attacker running on the same network to read any image file accessible to the Node.js process, potentially exposing sensitive system files or application data.

Technologies: [Astro](https://junglewise.ai/threats/technologies/astro-astro), [astro (npm)](https://junglewise.ai/threats/technologies/astro). Vendors: [Astro](https://junglewise.ai/threats/vendors/astro), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2025-64757 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-64757 being exploited in the wild.

**How severe is CVE-2025-64757?** Low severity, with a CVSS score of 3.5, published 19 November 2025.

**Which products and versions are affected?** astro (npm) SEMVER:introduced=0,fixed=5.14.3.

**Is there a fix for CVE-2025-64757?** Yes. astro (npm): upgrade to 5.14.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-64757 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2025-64757?** Check whether you run Astro or astro (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- astro (npm): upgrade to 5.14.3 or later

  ```sh
  npm install astro@5.14.3
  ```


## Technical details

The vulnerability is a path traversal flaw (CWE-22) in the Node.js image endpoint handler (packages/astro/src/assets/endpoint/node.ts) used during development mode. The endpoint accepts an href parameter without proper validation in development mode, allowing absolute file paths to be specified. An attacker with network access to the development server (typically running on localhost:4321) can craft HTTP GET requests to the /_image endpoint with absolute paths, bypassing the path restrictions that exist in the production code path. The attack requires the development server to be running and the target image files to be readable by the Node.js process. Exploitation results in arbitrary local file read, with the attacker receiving the image contents in the HTTP response. The vulnerability is fixed in Astro version 5.14.3 and later.

## Affected products

- Astro Astro < 5.14.3

## Identifiers

- CVE-2025-64757
- GHSA-x3h8-62x9-952g

## Timeline

- 2025-11-19: disclosed
- 2025-11-19: patched: Fixed in version 5.14.3

## References

- [https://github.com/withastro/astro/security/advisories/GHSA-x3h8-62x9-952g](https://github.com/withastro/astro/security/advisories/GHSA-x3h8-62x9-952g)

## Related threats

- [Astro case-sensitive path bypass in image endpoint](https://junglewise.ai/threats/cve-2026-126364-astro-is-a-web-framework-for-content-driven-websites-from-5-14-3)
- [Astro HTML injection in dynamic element rendering](https://junglewise.ai/threats/cve-2026-126361-astro-is-a-web-framework-for-content-driven-websites-prior-to-7)
- [Astro HTML injection in script and style element rendering](https://junglewise.ai/threats/cve-2026-114128-astro-is-a-web-framework-for-content-driven-websites-prior-to-7)
- [Astro CSS injection in View Transition animation values](https://junglewise.ai/threats/cve-2026-114127-astro-is-a-web-framework-for-content-driven-websites-from-7-1-0)
- [Astro remote code execution via AVIF image processing](https://junglewise.ai/threats/astro-remote-code-execution-via-avif-image-processing-6b99ffe8)