758 matches found
CVE-2025-64525
Summary: Astro 2.16.0 to before 5.15.5 is vulnerable to header-based URL manipulation due to insecure use of unsanitized x-forwarded-proto and x-forwarded-port when building URLs. What’s affected: Astro’s server-side URL construction path uses the header values to compose the request URL in code ...
CVE-2025-64525 Astro: URL manipulation via unsanitized headers leads to path-based middleware protections bypass, potential SSRF/cache-poisoning, CVE-2025-61925 bypass
Astro is a web framework. In Astro versions 2.16.0 up to but excluding 5.15.5 which utilizeon-demand rendering, request headers x-forwarded-proto and x-forwarded-port are insecurely used, without sanitization, to build the URL. This has several consequences, the most important of which are:...
CVE-2025-64525 Astro: URL manipulation via unsanitized headers leads to path-based middleware protections bypass, potential SSRF/cache-poisoning, CVE-2025-61925 bypass
Astro is a web framework. In Astro versions 2.16.0 up to but excluding 5.15.5 which utilizeon-demand rendering, request headers x-forwarded-proto and x-forwarded-port are insecurely used, without sanitization, to build the URL. This has several consequences, the most important of which are:...
EUVD-2025-177986
Malicious code in magellan-astro-webdriverio-enceladus npm...
EUVD-2025-179369
Malicious code in deimos-ceres-astro-isostasy npm...
EUVD-2025-180531
Malicious code in abiogenesis-proxima-astro-backend npm...
EUVD-2025-180302
Malicious code in astro-ignite-scripts-pulsar npm...
EUVD-2025-180301
Malicious code in astro-photon-publish-blazar npm...
MAL-2025-188351 Malicious code in nova-astro-playwright-mira (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8be6aa5807609425f2a33e522f29ae44baadab83adcc49c1bc3035527e455cbd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
MAL-2025-187896 Malicious code in magellan-astro-webdriverio-enceladus (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 956002abb27a2f289c68e054e9fd9ee1991e2691200e686d03be1ff32801893e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-180350
Malicious code in archaeometry-rollup-plugin-astro-install npm...
EUVD-2025-180170
Malicious code in axios-astro-html-webpack-plugin-algol npm...
EUVD-2025-176014
Malicious code in terraforming-astro-virgo-toml npm...
EUVD-2025-176888
Malicious code in pyxis-asthenosphere-astro-server npm...
EUVD-2025-177531
Malicious code in nova-astro-playwright-mira npm...
Malicious code in testcafe-titan-fornax-astro (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 505ab67a6297012e58bbbca384b01496596446cd811f997a2a86a2baf414a6d7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
Malicious code in astro-helios-nightwatch-sagitta (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c597e6e94b0dc9824b4353d492fad15b37f4cfe800812bcf2c4174a1e8e63b3b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-178275
Malicious code in jest-astro-despina-aurora npm...