MAL-2025-45614 Malicious code in proxima-ignite-astro-protoplanetarydisk (npm)

The package proxima-ignite-astro-protoplanetarydisk was found to contain malicious code...

Malicious code in astro-sagitta-exobiology-html-webpack-plugin (npm)

The package astro-sagitta-exobiology-html-webpack-plugin was found to contain malicious code...

MAL-2025-45799 Malicious code in remark-exoplanetology-meissa-astro (npm)

The package remark-exoplanetology-meissa-astro was found to contain malicious code...

MAL-2025-43523 Malicious code in astro-postcss-loader-grunt-selenium (npm)

The package astro-postcss-loader-grunt-selenium was found to contain malicious code...

Malicious code in astro-postcss-loader-grunt-selenium (npm)

The package astro-postcss-loader-grunt-selenium was found to contain malicious code...

Malicious code in astro-mantle-accretion-deimos (npm)

The package astro-mantle-accretion-deimos was found to contain malicious code...

Malicious code in bionics-astro-prompts-meteor (npm)

The package bionics-astro-prompts-meteor was found to contain malicious code...

Astro code issues and vulnerabilities

Astro is an Astro open source web framework for content-driven websites. A code issue vulnerability exists in Astro versions 11.0.3 through 12.6.5 that stems from the presence of SSRF in the Cloudflare adapter, which could allow bypassing third-party domain restrictions...

CVE-2025-58179: Server-Side Request Forgery (SSRF)

Astro is a web framework for content-driven websites. Versions 11.0.3 through 12.6.5 are vulnerable to SSRF when using Astro's Cloudflare adapter. When configured with output: 'server' while using the default imageService: 'compile', the generated image optimization endpoint doesn't check the URL...

CVE-2025-58179 Astro Cloudflare adapter is vulnerable to Server-Side Request Forgery via /_image endpoint

Astro is a web framework for content-driven websites. Versions 11.0.3 through 12.6.5 are vulnerable to SSRF when using Astro's Cloudflare adapter. When configured with output: 'server' while using the default imageService: 'compile', the generated image optimization endpoint doesn't check the URL...

CVE-2025-58179

Astro exposes an SSRF flaw in versions 11.0.3–12.6.5 when using the Cloudflare adapter with output: 'server' and the default imageService: 'compile'. The image optimization endpoint does not validate received URLs, enabling content from unauthorized third-party domains to be served. Root cause: a...

CVE-2025-58179

Astro is a web framework for content-driven websites. Versions 11.0.3 through 12.6.5 are vulnerable to SSRF when using Astro's Cloudflare adapter. When configured with output: 'server' while using the default imageService: 'compile', the generated image optimization endpoint doesn't check the URL...

CVE-2025-58179 Astro Cloudflare adapter is vulnerable to Server-Side Request Forgery via /_image endpoint

Astro is a web framework for content-driven websites. Versions 11.0.3 through 12.6.5 are vulnerable to SSRF when using Astro's Cloudflare adapter. When configured with output: 'server' while using the default imageService: 'compile', the generated image optimization endpoint doesn't check the URL...

@vdart-code/web (1.19.0), @wix/cloud-provider-fetch-adapter (>=1.0.1, <=1.0.5) +2 more potentially affected by CVE-2025-58179 via @astrojs/cloudflare (>=11.2.0, <=12.6.3)

@astrojs/cloudflare NPM version =11.2.0, =1.0.1, =0.0.11, =1.0.37, =1.1.3 Source cves: CVE-2025-58179 Source advisory: OSV:GHSA-QPR4-C339-7VQ8...

GHSA-QPR4-C339-7VQ8 Server-Side Request Forgery via /_image endpoint in Astro Cloudflare adapter

Summary When using Astro's Cloudflare adapter @astrojs/cloudflare configured with output: 'server' while using the default imageService: 'compile', the generated image optimization endpoint doesn't check the URLs it receives, allowing content from unauthorized third-party domains to be served...

CVE-2025-55303

Astro is a web framework for content-driven websites. In versions of astro before 5.13.2 and 4.16.18, the image optimization endpoint in projects deployed with on-demand rendering allows images from unauthorized third-party domains to be served. On-demand rendered sites built with Astro include a...

CVE-2025-55303

Astro is a web framework for content-driven websites. In versions of astro before 5.13.2 and 4.16.18, the image optimization endpoint in projects deployed with on-demand rendering allows images from unauthorized third-party domains to be served. On-demand rendered sites built with Astro include a...

CVE-2025-55303

Astro before 5.13.2 and 4.16.18 has an information disclosure vulnerability in the on-demand rendering image optimization endpoint (_image) that can bypass third-party domain restrictions using protocol-relative URLs (e.g., /_image?href=//example.com/image.png). This allows serving images from un...

@ampt/astro (0.0.1-beta.1), @asherng/css-ui (>=0.0.17, <=0.0.18) +203 more potentially affected by CVE-2025-55303 via astro (>=0.20.12, <=4.16.18)

astro NPM version =0.20.12, =0.0.17, =0.0.2, =0.0.1, =0.2.0, =0.0.1, =0.1.30, =1.0.0, =1.0.0, =3.6.0-beta.0, =3.10.1 - @bookshop/browser 3.11.0-rc.0 - @bookshop/generate 3.11.0-rc.0 and more Source cves: CVE-2025-55303 Source advisory: MEND:CVE-2025-55303...

@1771technologies/oneplay (>=0.0.1, <=0.0.6), @antonyfaris/prefix-node-builtins (>=1.0.0, <=1.0.1) +23 more potentially affected by CVE-2025-55303 via astro (>=5.0.0-beta.5, <=5.12.8)

astro NPM version =5.0.0-beta.5, =0.0.1, =1.0.0, =0.0.1, =1.25.426-4, =0.6.2, =0.0.0-dev-20250414184926, =0.0.1, =0.0.1, =0.0.1, =2.1.22, =1.0.3, =0.1.0, =0.4.2 and more Source cves: CVE-2025-55303 Source advisory: MEND:CVE-2025-55303...