CVE-2025-64525: Astro Package URL Manipulation Vulnerability Leading to Middleware Bypass
Summary
CVE-2025-64525: Astro vulnerable to URL manipulation via headers, leading to middleware and CVE-2025-61925 bypass. Affects astro versions >= 2.16.0, < 5.15.5. Fixed in 5.15.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Astro is a modern static site generator that enables developers to build fast websites using a component-based architecture. It supports on-demand rendering, allowing pages to be rendered at request time, which enhances performance and user experience. However, certain versions of Astro are vulnerable to URL manipulation through insecure handling of request headers, specifically 'x-forwarded-proto' and 'x-forwarded-port'.
Vulnerability Detail
The vulnerability arises from the insecure use of the 'x-forwarded-proto' and 'x-forwarded-port' headers in the Astro server code, particularly in the 'createRequest()' function. These headers are used without proper sanitization to construct URLs, leading to several potential exploits, including middleware-based route bypass, denial of service via cache poisoning, server-side request forgery (SSRF), URL pollution, and web application firewall (WAF) bypass. An attacker can manipulate the headers to rewrite URLs, allowing unauthorized access to protected routes or causing the application to serve malicious content.
How To Fix
Latest published version: 7.4.2 as of 23 Oct 2026
npm install astro@7.4.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
5.15.5
This is the first release that contains the fix.
npm install astro@5.15.5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement custom middleware to validate and sanitize the 'x-forwarded-proto' and 'x-forwarded-port' headers before they are used in URL construction. For example:
export const onRequest = defineMiddleware(async (context, next) => {
const validProtocols = ['http', 'https'];
const protocol = context.request.headers.get('x-forwarded-proto');
if (!validProtocols.includes(protocol)) {
return context.redirect('/error'); // Redirect to an error page if the protocol is invalid
}
return next();
});
Conclusion
The Astro package has a vulnerability that allows for URL manipulation through insecure handling of specific request headers. This can lead to serious security issues, including unauthorized access and denial of service. It is crucial to update to the patched version to mitigate these risks and ensure the security of your application.
See every vulnerability recorded for astro →
FAQ
The vulnerability affects Astro versions prior to 5.15.5.
Potential consequences include unauthorized access to protected routes, denial of service, SSRF attacks, and the ability to serve malicious content.
You can use Vulert, which monitors open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without needing to sign up.
The CVSS score of this vulnerability is 6.5, indicating a moderate severity level.
Yes, you can implement custom middleware to validate and sanitize the affected headers as a temporary measure.
References
Related vulnerabilities
Recent vulnerabilities recorded for astro.
