{"id":"EUVD-2025-175298","enisaUuid":"926947fa-8f99-3088-9295-f300d6ec6e7d","description":"Astro is a web framework. In Astro versions 2.16.0 up to but excluding 5.15.5 which utilizeon-demand rendering, request headers `x-forwarded-proto` and `x-forwarded-port` are insecurely used, without sanitization, to build the URL. This has several consequences, the most important of which are: middleware-based protected route bypass (only via `x-forwarded-proto`), DoS via cache poisoning (if a CDN is present), SSRF (only via `x-forwarded-proto`), URL pollution (potential SXSS, if a CDN is present), and WAF bypass. Version 5.15.5 contains a patch.","datePublished":"Nov 13, 2025, 3:58:16 PM","dateUpdated":"Nov 13, 2025, 4:15:18 PM","baseScore":6.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","references":"https://github.com/withastro/astro/security/advisories/GHSA-hr2q-hp5q-x767\nhttps://github.com/withastro/astro/commit/dafbb1ba29912099c4faff1440033edc768af8b4\nhttps://github.com/withastro/astro/blob/970ac0f51172e1e6bff4440516a851e725ac3097/packages/astro/src/core/app/node.ts#L121\nhttps://github.com/withastro/astro/blob/970ac0f51172e1e6bff4440516a851e725ac3097/packages/astro/src/core/app/node.ts#L97\n","aliases":"CVE-2025-64525\nGHSA-hr2q-hp5q-x767\n","assigner":"GitHub_M","epss":1.25,"enisaIdProduct":[{"id":"f7f43db8-bbe3-3d66-abe3-e4314e96bff0","product":{"name":"astro","vendor":{"name":"withastro"}},"product_version":"2.16.0, \u003c 5.15.5"}],"enisaIdVendor":[{"id":"70a25240-e35e-3881-99f7-d806c7c69b03","vendor":{"name":"withastro"}}],"enisaIdVulnerability":[{"id":"3b79ffff-d9a4-3633-a4dc-1c242d3543b4","vulnerability":{"id":"GHSA-hr2q-hp5q-x767","description":"Astro vulnerable to URL manipulation via headers, leading to middleware and CVE-2025-61925 bypass","datePublished":"Nov 13, 2025, 10:46:24 PM","dateUpdated":"Nov 13, 2025, 10:46:24 PM","baseScore":0.0,"references":"https://github.com/withastro/astro/security/advisories/GHSA-hr2q-hp5q-x767\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-64525\nhttps://github.com/withastro/astro/commit/dafbb1ba29912099c4faff1440033edc768af8b4\nhttps://github.com/withastro/astro\nhttps://github.com/withastro/astro/blob/970ac0f51172e1e6bff4440516a851e725ac3097/packages/astro/src/core/app/node.ts#L121\nhttps://github.com/withastro/astro/blob/970ac0f51172e1e6bff4440516a851e725ac3097/packages/astro/src/core/app/node.ts#L97\n","enisa_id":"EUVD-2025-175298\n","aliases":"GHSA-hr2q-hp5q-x767\nCVE-2025-64525\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 1:56:19 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"6ee22d9a-7797-3fc7-8370-8e3333db8a10","vulnerability":{"id":"CVE-2025-64525","description":"Astro is a web framework. In Astro versions 2.16.0 up to but excluding 5.15.5 which utilizeon-demand rendering, request headers `x-forwarded-proto` and `x-forwarded-port` are insecurely used, without sanitization, to build the URL. This has several consequences, the most important of which are: middleware-based protected route bypass (only via `x-forwarded-proto`), DoS via cache poisoning (if a CDN is present), SSRF (only via `x-forwarded-proto`), URL pollution (potential SXSS, if a CDN is present), and WAF bypass. Version 5.15.5 contains a patch.","datePublished":"Nov 13, 2025, 3:58:16 PM","dateUpdated":"Nov 13, 2025, 4:15:18 PM","status":"PUBLISHED","baseScore":6.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","references":"https://github.com/withastro/astro/security/advisories/GHSA-hr2q-hp5q-x767\nhttps://github.com/withastro/astro/commit/dafbb1ba29912099c4faff1440033edc768af8b4\nhttps://github.com/withastro/astro/blob/970ac0f51172e1e6bff4440516a851e725ac3097/packages/astro/src/core/app/node.ts#L121\nhttps://github.com/withastro/astro/blob/970ac0f51172e1e6bff4440516a851e725ac3097/packages/astro/src/core/app/node.ts#L97\n","enisa_id":"EUVD-2025-175298\n","assigner":"GitHub_M","epss":1.25,"dataProcessed":"Nov 6, 2026, 7:21:17 AM","vulnerabilityProduct":[{"id":"aaa8b587-54ac-3925-8a7d-90121cb52d99","product":{"name":"astro","vendor":{"name":"withastro"}},"product_version":"2.16.0, \u003c 5.15.5"}],"vulnerabilityVendor":[{"id":"7c15a3fa-d142-3285-a489-ec785d91eb4c","vendor":{"name":"withastro"}}]}}],"enisaIdAdvisory":[]}