CVE-2025-64525 Astro: URL manipulation via unsanitized headers leads to path-based middleware protections bypass, potential SSRF/cache-poisoning, CVE-2025-61925 bypass

Astro is a web framework. In Astro versions 2.16.0 up to but excluding 5.15.5 which utilizeon-demand rendering, request headers x-forwarded-proto and x-forwarded-port are insecurely used, without sanitization, to build the URL. This has several consequences, the most important of which are:...

CVE-2025-64525

Summary: Astro 2.16.0 to before 5.15.5 is vulnerable to header-based URL manipulation due to insecure use of unsanitized x-forwarded-proto and x-forwarded-port when building URLs. What’s affected: Astro’s server-side URL construction path uses the header values to compose the request URL in code ...

CVE-2025-64525 Astro: URL manipulation via unsanitized headers leads to path-based middleware protections bypass, potential SSRF/cache-poisoning, CVE-2025-61925 bypass

Astro is a web framework. In Astro versions 2.16.0 up to but excluding 5.15.5 which utilizeon-demand rendering, request headers x-forwarded-proto and x-forwarded-port are insecurely used, without sanitization, to build the URL. This has several consequences, the most important of which are:...

EUVD-2025-177845

Malicious code in middleware-backend-async-oortcloud npm...

Malicious code in changelog-middleware-koa-betelgeuse (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector daa17e71d0659ec9eba2081fe5d20c537b2421455d8e4534a085af5fccaaf246 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-177659

Malicious code in neptune-middleware-mongoose-neptunology npm...

EUVD-2025-177843

Malicious code in middleware-exec-callisto-postcss-loader npm...

EUVD-2025-177690

Malicious code in nconf-middleware-extremophile-cosmicweb npm...

EUVD-2025-176629

Malicious code in rimraf-middleware-mysql-pavo npm...

Malicious code in neptune-middleware-mongoose-neptunology (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4d0a7212482567b4ff70ad523ee9502116475db634fa180bfd66e4025e91737e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-179200

Malicious code in eclipse-ursa-element-ui-middleware npm...

Malicious code in socketio-chalk-middleware-public (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5456f60ff4b15c35d27afbffb27cbe1a99bfed860e26c0f7ecd263251301e09b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in soap-callback-convict-middleware (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1b4922425b583d08a372e377d0b2ee372ad8912aa2da5902301f4c5ec520af10 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-177840

Malicious code in middleware-mini-css-extract-plugin-ignite-json npm...

EUVD-2025-179047

Malicious code in eslint-config-jovian-middleware-init npm...

EUVD-2025-176667

Malicious code in resonance-middleware-octans-graviton npm...

EUVD-2025-179334

Malicious code in deneb-juno-virtualreality-middleware npm...

MAL-2025-189576 Malicious code in socketio-chalk-middleware-public (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5456f60ff4b15c35d27afbffb27cbe1a99bfed860e26c0f7ecd263251301e09b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-186810 Malicious code in eridanus-middleware-meissa-io (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 39d8052daae1ed8ab3fc26fdaab3f01d80ab551e461e94217d3ab36440d1b583 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-189052 Malicious code in quito-rocket-radiant-middleware (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bb1027d85e5f5fe77252e470808dec33a66a0131fb5706d9c2bdc7aef3e9a7b4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...