CVE-2025-64745

Astro is a web framework. Starting in version 5.2.0 and prior to version 5.15.6, a Reflected Cross-Site Scripting XSS vulnerability exists in Astro's development server error pages when the trailingSlash configuration option is used. An attacker can inject arbitrary JavaScript code that executes ...

CVE-2025-64525

Astro is a web framework. In Astro versions 2.16.0 up to but excluding 5.15.5 which utilizeon-demand rendering, request headers x-forwarded-proto and x-forwarded-port are insecurely used, without sanitization, to build the URL. This has several consequences, the most important of which are:...

EUVD-2025-175298

Astro vulnerable to URL manipulation via headers, leading to middleware and CVE-2025-61925 bypass...

@1771technologies/oneplay (>=0.0.1, <=0.0.6), @antonyfaris/prefix-node-builtins (>=1.0.0, <=1.0.1) +265 more potentially affected by CVE-2025-64525 via astro (>=3.0.12, <=5.15.1)

astro NPM version =3.0.12, =0.0.1, =1.0.0, =0.5.0, =1.0.0, =0.2.0, =0.0.0-experimental-7c2f356, =0.0.0-experimental-7c2f356, =0.0.1, =0.0.1, =0.1.3, =0.1.0, =0.1.0-beta.0, =0.2.1 and more Source cves: CVE-2025-64525 Source advisory: OSV:GHSA-HR2Q-HP5Q-X767...

GHSA-HR2Q-HP5Q-X767 Astro vulnerable to URL manipulation via headers, leading to middleware and CVE-2025-61925 bypass

Summary In impacted versions of Astro using on-demand rendering, request headers x-forwarded-proto and x-forwarded-port are insecurely used, without sanitization, to build the URL. This has several consequences the most important of which are: - Middleware-based protected route bypass only via...

@1771technologies/oneplay (>=0.0.1, <=0.0.6), @antonyfaris/prefix-node-builtins (>=1.0.0, <=1.0.1) +265 more potentially affected by CVE-2025-61925 +1 more via astro (>=3.0.12, <=5.15.1)

astro NPM version =3.0.12, =0.0.1, =1.0.0, =0.5.0, =1.0.0, =0.2.0, =0.0.0-experimental-7c2f356, =0.0.0-experimental-7c2f356, =0.0.1, =0.0.1, =0.1.3, =0.1.0, =0.1.0-beta.0, =0.2.1 and more Source cves: CVE-2025-61925, CVE-2025-64525 Source advisory: GHSA-HR2Q-HP5Q-X767...

Cross-site Scripting (XSS)

Overview astro is an Astro is a modern site builder with web best practices, performance, and DX front-of-mind. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the corrected variable in the error page template when the trailingSlash configuration is set to 'always...

@1771technologies/oneplay (>=0.0.1, <=0.0.6), @antonyfaris/prefix-node-builtins (>=1.0.0, <=1.0.1) +31 more potentially affected by CVE-2025-64745 via astro (>=5.2.1, <=5.15.1)

astro NPM version =5.2.1, =0.0.1, =1.0.0, =0.5.0, =0.0.1, =0.1.0, =0.0.1, =2.18.7, =1.25.426-4, =0.6.2, =0.1.2-alpha.1, =0.0.28, =0.0.28, =0.0.40 and more Source cves: CVE-2025-64745 Source advisory: SNYK:JS-ASTRO-13961435...

@1771technologies/oneplay (>=0.0.1, <=0.0.6), @antonyfaris/prefix-node-builtins (>=1.0.0, <=1.0.1) +31 more potentially affected by CVE-2025-64745 via astro (>=5.2.1, <=5.15.1)

astro NPM version =5.2.1, =0.0.1, =1.0.0, =0.5.0, =0.0.1, =0.1.0, =0.0.1, =2.18.7, =1.25.426-4, =0.6.2, =0.1.2-alpha.1, =0.0.28, =0.0.28, =0.0.40 and more Source cves: CVE-2025-64745 Source advisory: GHSA-W2VJ-39QV-7VH7...

@1771technologies/oneplay (>=0.0.1, <=0.0.6), @antonyfaris/prefix-node-builtins (>=1.0.0, <=1.0.1) +31 more potentially affected by CVE-2025-64745 via astro (>=5.2.1, <=5.15.1)

astro NPM version =5.2.1, =0.0.1, =1.0.0, =0.5.0, =0.0.1, =0.1.0, =0.0.1, =2.18.7, =1.25.426-4, =0.6.2, =0.1.2-alpha.1, =0.0.28, =0.0.28, =0.0.40 and more Source cves: CVE-2025-64745 Source advisory: OSV:GHSA-W2VJ-39QV-7VH7...

GHSA-W2VJ-39QV-7VH7 Astro development server error page is vulnerable to reflected Cross-site Scripting

Summary A Reflected Cross-Site Scripting XSS vulnerability exists in Astro's development server error pages when the trailingSlash configuration option is used. An attacker can inject arbitrary JavaScript code that executes in the victim's browser context by crafting a malicious URL. While this...

Astro development server error page is vulnerable to reflected Cross-site Scripting

Summary A Reflected Cross-Site Scripting XSS vulnerability exists in Astro's development server error pages when the trailingSlash configuration option is used. An attacker can inject arbitrary JavaScript code that executes in the victim's browser context by crafting a malicious URL. While this...

CVE-2025-64745

Astro is a web framework. Starting in version 5.2.0 and prior to version 5.15.6, a Reflected Cross-Site Scripting XSS vulnerability exists in Astro's development server error pages when the trailingSlash configuration option is used. An attacker can inject arbitrary JavaScript code that executes ...

CVE-2025-64745 Astro development server error page vulnerable to reflected Cross-site Scripting

Astro is a web framework. Starting in version 5.2.0 and prior to version 5.15.6, a Reflected Cross-Site Scripting XSS vulnerability exists in Astro's development server error pages when the trailingSlash configuration option is used. An attacker can inject arbitrary JavaScript code that executes ...

CVE-2025-64745

CVE-2025-64745 affects Astro’s development server only. When trailingSlash is enabled, the dev 404 page can reflect an attacker-controlled pathname and inject arbitrary JavaScript, enabling a reflected XSS in the victim’s browser. Affected versions: 5.2.0 up to 5.15.5; fixed in 5.15.6. Impact is ...

CVE-2025-64745 Astro development server error page vulnerable to reflected Cross-site Scripting

Astro is a web framework. Starting in version 5.2.0 and prior to version 5.15.6, a Reflected Cross-Site Scripting XSS vulnerability exists in Astro's development server error pages when the trailingSlash configuration option is used. An attacker can inject arbitrary JavaScript code that executes ...

@1771technologies/oneplay (>=0.0.1, <=0.0.6), @antonyfaris/prefix-node-builtins (>=1.0.0, <=1.0.1) +31 more potentially affected by CVE-2025-64745 via astro (>=5.2.1, <=5.15.1)

astro NPM version =5.2.1, =0.0.1, =1.0.0, =0.5.0, =0.0.1, =0.1.0, =0.0.1, =2.18.7, =1.25.426-4, =0.6.2, =0.1.2-alpha.1, =0.0.28, =0.0.28, =0.0.40 and more Source cves: CVE-2025-64745 Source advisory: MEND:CVE-2025-64745...

@1771technologies/oneplay (>=0.0.1, <=0.0.6), @antonyfaris/prefix-node-builtins (>=1.0.0, <=1.0.1) +34 more potentially affected by CVE-2025-61925 +1 more via astro (>=5.0.0-beta.5, <=5.15.1)

astro NPM version =5.0.0-beta.5, =0.0.1, =1.0.0, =0.5.0, =0.0.1, =0.1.0, =0.0.1, =2.18.7, =1.25.426-4, =0.6.2, =0.1.2-alpha.1, =0.0.28, =0.0.28, =0.0.40 and more Source cves: CVE-2025-61925, CVE-2025-64525 Source advisory: SNYK:JS-ASTRO-13961342...

Server-side Request Forgery (SSRF)

Overview astro is an Astro is a modern site builder with web best practices, performance, and DX front-of-mind. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the x-forwarded-proto and x-forwarded-port headers due to improper input sanitization when...

CVE-2025-64525

Astro is a web framework. In Astro versions 2.16.0 up to but excluding 5.15.5 which utilizeon-demand rendering, request headers x-forwarded-proto and x-forwarded-port are insecurely used, without sanitization, to build the URL. This has several consequences, the most important of which are:...