@antonyfaris/prefix-node-builtins (>=1.0.0 <=1.0.1), @anyauth/design-system (>=0.5.0 <=0.5.1) +305 more potentially affected by CVE-2025-64525 via astro (>=2.1.2 <=5.15.1)

astro NPM version =2.1.2, =1.0.0, =0.5.0, =1.0.0, =0.0.17, =0.0.2, =0.2.0, =0.0.0-experimental-7c2f356, =0.0.0-experimental-7c2f356, =0.0.1, =0.0.1, =0.1.3, =0.1.4 - @bankai/byte-blocks =0.3.1 and more Source cves: CVE-2025-64525 Source advisory: OSV:GHSA-HR2Q-HP5Q-X767...

GHSA-HR2Q-HP5Q-X767 Astro vulnerable to URL manipulation via headers, leading to middleware and CVE-2025-61925 bypass

Summary In impacted versions of Astro using on-demand rendering, request headers x-forwarded-proto and x-forwarded-port are insecurely used, without sanitization, to build the URL. This has several consequences the most important of which are: - Middleware-based protected route bypass only via...

@antonyfaris/prefix-node-builtins (>=1.0.0 <=1.0.1), @anyauth/design-system (>=0.5.0 <=0.5.1) +17 more potentially affected by CVE-2025-61925 +1 more via astro (>=5.0.0-beta.5 <=5.15.1)

astro NPM version =5.0.0-beta.5, =1.0.0, =0.5.0, =0.0.1, =0.1.0, =0.0.1, =2.18.7, =0.1.2-alpha.1, =0.0.28, =0.0.28, =1.13.2, =0.1.8, =1.0.21, =0.0.1, =0.0.20 and more Source cves: CVE-2025-61925, CVE-2025-64525 Source advisory: SNYK:JS-ASTRO-13961342...

@antonyfaris/prefix-node-builtins (>=1.0.0 <=1.0.1), @awesome-myst/myst-awesome (>=0.0.1 <=0.0.7) +10 more potentially affected by CVE-2025-61925 via astro (>=5.0.0-beta.5 <=5.14.1)

astro NPM version =5.0.0-beta.5, =1.0.0, =0.0.1, =0.0.1, =2.18.7, =0.1.2-alpha.1, =1.13.2, =0.1.8, =1.0.21, =0.0.1, =0.0.1, =1.249.8, =1.271.1 Source cves: CVE-2025-61925 Source advisory: SNYK:JS-ASTRO-13535085...

@antonyfaris/prefix-node-builtins (>=1.0.0 <=1.0.1), @awesome-myst/myst-awesome (>=0.0.1 <=0.0.7) +7 more potentially affected by CVE-2025-55303 via astro (>=5.0.0-beta.5 <=5.13.10)

astro NPM version =5.0.0-beta.5, =1.0.0, =0.0.1, =0.0.1, =0.1.8, =0.0.1, =0.0.1, =1.249.8, =1.267.0 Source cves: CVE-2025-55303 Source advisory: SNYK:JS-ASTRO-12027668...

@antonyfaris/prefix-node-builtins (>=1.0.0 <=1.0.1), @awesome-myst/myst-awesome (>=0.0.1 <=0.0.7) +7 more potentially affected by CVE-2025-55303 via astro (>=5.0.0-beta.5 <=5.13.10)

astro NPM version =5.0.0-beta.5, =1.0.0, =0.0.1, =0.0.1, =0.1.8, =0.0.1, =0.0.1, =1.249.8, =1.267.0 Source cves: CVE-2025-55303 Source advisory: OSV:GHSA-XF8X-J4P2-F749...

CVE-2025-55207

Astro is a web framework for content-driven websites. Following CVE-2025-54793 there's still an Open Redirect vulnerability in a subset of Astro deployment scenarios prior to version 9.4.1. Astro 5.12.8 addressed CVE-2025-54793 where https://example.com//astro.build/press would redirect to the...

Astros's duplicate trailing slash feature leads to an open redirection security issue

Summary There is an Open Redirection vulnerability in the trailing slash redirection logic when handling paths with double slashes. This allows an attacker to redirect users to arbitrary external domains by crafting URLs such as https://mydomain.com//malicious-site.com/. This increases the risk o...

GHSA-CQ8C-XV66-36GW Astros's duplicate trailing slash feature leads to an open redirection security issue

Summary There is an Open Redirection vulnerability in the trailing slash redirection logic when handling paths with double slashes. This allows an attacker to redirect users to arbitrary external domains by crafting URLs such as https://mydomain.com//malicious-site.com/. This increases the risk o...

PT-2025-32332

Name of the Vulnerable Software and Affected Versions Astro versions 5.2.0 through 5.12.7 Description Astro is susceptible to an Open Redirect vulnerability stemming from improper handling of paths containing double slashes in its trailing slash redirection logic. This allows an attacker to...

@ampt/astro (=0.0.1-beta.1), @asherng/css-ui (>=0.0.17 <=0.0.18) +192 more potentially affected by CVE-2024-56140 via astro (>=0.20.12 <=4.16.16)

astro NPM version =0.20.12, =0.0.17, =0.0.2, =0.0.1, =0.2.0, =0.0.1, =0.1.30, =1.0.0, =1.0.0, =3.6.0, =3.10.1 - @bookshop/browser =3.11.0-rc.0 - @bookshop/generate =3.11.0-rc.0 and more Source cves: CVE-2024-56140 Source advisory: OSV:GHSA-C4PW-33H3-35XW...

@astro-reactive/common (>=0.2.0 <=0.2.1), @bookshop/astro-engine (>=3.7.0 <=3.10.1) +57 more potentially affected by CVE-2024-47885 via astro (>=3.0.12 <=4.15.9)

astro NPM version =3.0.12, =0.2.0, =3.7.0, =0.40.5, =0.34.0, =0.34.0, =0.0.2, =2.0.0, =0.0.0-test-20230907022505, =0.0.1, =0.0.1, =0.0.6, =0.1.4 and more Source cves: CVE-2024-47885 Source advisory: OSV:GHSA-M85W-3H95-HCF9...