Is CVE-2025-65019 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-65019 being exploited in the wild.

How severe is CVE-2025-65019?

Medium severity, with a CVSS score of 5.4, published 19 November 2025.

Which products and versions are affected?

astro (npm) SEMVER:introduced=0,fixed=5.15.9.

Is there a fix for CVE-2025-65019?

Yes. astro (npm): upgrade to 5.15.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-65019 attacked?

It is attacked over the network.

Am I affected by CVE-2025-65019?

Check whether you run Astro or astro (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-65019: Astro Cloudflare adapter stored XSS in /_image endpoint

CVE-2025-65019 · Severity: medium · CVSS 5.4 · Published 2025-11-19

Astro's Cloudflare adapter contains a cross-site scripting vulnerability in its image optimization endpoint. When processing image requests, the endpoint redirects to data: URLs without properly sanitizing them, allowing attackers to embed and execute malicious JavaScript in SVG images. This could lead to session hijacking, account takeover, or theft of sensitive data from site visitors.

Technologies: Astro, astro (npm). Vendors: Astro, npm.

Quick answers

Is CVE-2025-65019 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-65019 being exploited in the wild.
How severe is CVE-2025-65019?: Medium severity, with a CVSS score of 5.4, published 19 November 2025.
Which products and versions are affected?: astro (npm) SEMVER:introduced=0,fixed=5.15.9.
Is there a fix for CVE-2025-65019?: Yes. astro (npm): upgrade to 5.15.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-65019 attacked?: It is attacked over the network.
Am I affected by CVE-2025-65019?: Check whether you run Astro or astro (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

astro (npm): upgrade to 5.15.9 or later
```
npm install astro@5.15.9
```

Technical details

The vulnerability is a stored/reflected cross-site scripting (XSS) flaw in the /_image endpoint of the Astro Cloudflare adapter when running with output: 'server'. The root cause lies in the isRemoteAllowed() function, which unconditionally allows data: URLs without validation. When an attacker crafts a request with a data: URL parameter pointing to a malicious SVG containing JavaScript, the Cloudflare adapter performs a 302 redirect directly to the data: URL, causing the browser to render and execute the embedded script. This bypasses typical security controls like image.domains configuration and Content-Security-Policy. The vulnerability affects Astro versions before 5.15.9 and @astrojs/cloudflare versions up to 12.6.10. A patch is available in Astro 5.15.9.

Affected products

Astro Astro < 5.15.9 when using @astrojs/cloudflare adapter with output: 'server'
Astro @astrojs/cloudflare ≤ 12.6.10

Identifiers

CVE-2025-65019
GHSA-fvmw-cj7j-j39q

Timeline

2025-11-19: disclosed: Vulnerability disclosed via GHSA-fvmw-cj7j-j39q
2025-11-19: patched: Fixed in Astro 5.15.9

References

https://github.com/withastro/astro/security/advisories/GHSA-fvmw-cj7j-j39q

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.