CVE-2025-64757: Astro Framework Arbitrary Local File Read Vulnerability
Summary
CVE-2025-64757: Astro Development Server has Arbitrary Local File Read. Affects astro versions < 5.14.3. Fixed in 5.14.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Astro is a modern static site generator that enables developers to build fast websites with a focus on performance and ease of use. It supports various front-end frameworks and optimizes assets for delivery. However, a vulnerability in its development server allows unauthorized access to local files, posing a significant security risk.
Vulnerability Detail
A vulnerability has been identified in the Astro framework's development server that allows arbitrary local file read access through the image optimization endpoint. This issue arises from improper path validation in the development mode of the Node.js image endpoint handler. Attackers can exploit this vulnerability by sending crafted HTTP GET requests to access any image file that the Node.js process can read, leading to potential exposure of sensitive information.
How To Fix
Latest published version: 7.4.2 as of 23 Oct 2026
npm install astro@7.4.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
5.14.3
This is the first release that contains the fix.
npm install astro@5.14.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, avoid using the Astro development server in production environments. Ensure that the server is only used in a controlled development setting where access can be restricted.
Conclusion
The Astro framework has a critical vulnerability that allows arbitrary local file read access through its development server. Users are advised to update to the latest version to mitigate this risk. Utilizing tools like Vulert can further enhance security by providing real-time monitoring for vulnerabilities.
See every vulnerability recorded for astro →
FAQ
The vulnerability allows unauthorized access to local files through the Astro development server's image optimization endpoint.
If you are using Astro version 5.x, particularly 5.13.3, your application may be vulnerable. You can check your package-lock.json file or use Vulert to monitor for vulnerabilities.
The vulnerability can lead to unauthorized access to sensitive image files on the server, compromising confidentiality without affecting integrity or availability.
Yes, you can restrict access to the development server and avoid using it in production environments as a temporary workaround.
Vulert is a tool that monitors open-source vulnerabilities in your software using just the package-lock.json file. It provides real-time alerts for vulnerabilities, helping you maintain security.
References
Related vulnerabilities
Recent vulnerabilities recorded for astro.
