CVE-2025-65019

creationtimestamp| type| source ---|---|--- 2025-11-19 17:25:01+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m5yri5mqxv2k...

CVE-2025-65019 Astro Cloudflare adapter has a Stored Cross Site Scripting vulnerability in /_image endpoint

Astro is a web framework. Prior to version 5.15.9, when using Astro's Cloudflare adapter @astrojs/cloudflare with output: 'server', the image optimization endpoint /image contains a critical vulnerability in the isRemoteAllowed function that unconditionally allows data: protocol URLs. This enable...