CVE-2025-64745: Astro Development Server Error Page Vulnerable to Reflected XSS
Summary
CVE-2025-64745: Astro development server error page vulnerable to reflected Cross-site Scripting. Affects astro versions >= 5.2.0, < 5.15.6. Fixed in 5.15.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Astro is a modern static site generator that allows developers to build fast websites using their favorite frameworks. It features a development server that provides real-time feedback and error pages to assist developers during the building process. However, a vulnerability has been identified in the development server's error handling when the 'trailingSlash' configuration option is set, exposing developers to potential XSS attacks.
Vulnerability Detail
A Reflected Cross-Site Scripting (XSS) vulnerability exists in Astro's development server error pages when the 'trailingSlash' configuration option is used. The vulnerability was introduced in commit 536175528, where the 'corrected' variable, derived from the user-controlled 'pathname' parameter, is directly interpolated into the HTML without proper escaping. This allows an attacker to inject arbitrary JavaScript code that executes in the victim's browser context by crafting a malicious URL. While this vulnerability only affects the development server and not production builds, it poses risks such as session hijacking and local resource access.
How To Fix
Latest published version: 7.4.2 as of 23 Oct 2026
npm install astro@7.4.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
5.15.6
This is the first release that contains the fix.
npm install astro@5.15.6Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the development server with the 'trailingSlash' configuration set to 'always' or 'never' until the package is updated. Alternatively, ensure that the development server is not publicly accessible to mitigate the risk of exploitation.
Conclusion
The CVE-2025-64745 vulnerability in Astro's development server exposes developers to reflected XSS attacks due to improper handling of user input in error pages. It is crucial to update to the patched version 5.15.6 or later to mitigate this risk and ensure a secure development environment.
See every vulnerability recorded for astro →
FAQ
The CVSS score of this vulnerability is 2.7, indicating a low severity level.
No, this vulnerability only affects the development server and does not impact production builds.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. By using the Vulert playground, you can check if your application is affected without requiring access to the code or installation.
Potential risks include session hijacking, local resource access, and compromise of the developer environment through social engineering.
The vulnerability was introduced as part of a feature to redirect trailing slashes on on-demand rendered pages, where user-controlled input was not properly sanitized.
References
Related vulnerabilities
Recent vulnerabilities recorded for astro.
