CVE-2025-65019: Astro Cloudflare Adapter Stored XSS Vulnerability in Image Optimization Endpoint
Summary
CVE-2025-65019: Astro Cloudflare adapter has Stored Cross Site Scripting vulnerability in /_image endpoint. Affects astro versions < 5.15.9. Fixed in 5.15.9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Astro is a modern static site generator that allows developers to build fast websites using various frameworks. The Cloudflare adapter (@astrojs/cloudflare) enables Astro projects to deploy seamlessly on Cloudflare's infrastructure, providing features like image optimization. However, a critical vulnerability has been identified in the image optimization endpoint, which can lead to severe security risks.
Vulnerability Detail
The vulnerability arises from the 'isRemoteAllowed()' function in the Astro Cloudflare adapter, which unconditionally permits 'data:' protocol URLs without any validation. This oversight allows attackers to exploit the image optimization endpoint ('/_image') by injecting malicious SVG payloads, leading to Cross-Site Scripting (XSS) attacks. The implications of this vulnerability include the potential for session hijacking, account takeover, and data exfiltration, as malicious scripts can execute in the context of the victim's browser.
How To Fix
Minimum fixed version
5.15.9
This is the first release that contains the fix.
npm install astro@5.15.9Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the 'data:' protocol for image URLs in your Astro projects. Instead, host images on authorized domains or use local images to mitigate the risk of XSS attacks until the package is updated.
Conclusion
The CVE-2025-65019 vulnerability in the Astro Cloudflare adapter poses significant security risks due to its potential for XSS attacks. It is crucial for developers using this package to update to the patched version to safeguard their applications. Monitoring tools like Vulert can assist in identifying vulnerabilities in real-time.
See every vulnerability recorded for astro →
FAQ
The vulnerability is a Stored Cross-Site Scripting (XSS) issue that allows malicious SVG payloads to execute JavaScript in the user's browser.
If you are using the Astro Cloudflare adapter and have not updated to version 5.15.9 or later, your project may be vulnerable.
The impacts include session hijacking, account takeover, and data exfiltration, as attackers can execute scripts in the context of the victim's session.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in your software by analyzing the package-lock.json file.
You can use the Vulert playground at Vulert Scanner to check for vulnerabilities in your application without requiring an account.
References
Related vulnerabilities
Recent vulnerabilities recorded for astro.
