CVE-2025-61925

creationtimestamp| type| source ---|---|--- 2025-11-13 17:53:59+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m5jqcg4ohh26...

CVE-2025-61925 Astro's `X-Forwarded-Host` is reflected with no validation

Astro is a web framework. Prior to version 5.14.2, Astro reflects the value in X-Forwarded-Host in output when using Astro.url without any validation. It is common for web servers such as nginx to route requests via the Host header, and forward on other request headers. As such as malicious reque...