CVE-2025-64525

Astro is a web framework. In Astro versions 2.16.0 up to but excluding 5.15.5 which utilizeon-demand rendering, request headers `x-forwarded-proto` and `x-forwarded-port` are insecurely used, without sanitization, to build the URL. This has several consequences, the most important of which are: middleware-based protected route bypass (only via `x-forwarded-proto`), DoS via cache poisoning (if a CDN is present), SSRF (only via `x-forwarded-proto`), URL pollution (potential SXSS, if a CDN is present), and WAF bypass. Version 5.15.5 contains a patch.

• CWE-918

• https://github.com/withastro/astro/blob/970ac0f51172e1e6bff4440516a851e725ac3097/packages/astro/src/core/app/node.ts#L121Product
• https://github.com/withastro/astro/blob/970ac0f51172e1e6bff4440516a851e725ac3097/packages/astro/src/core/app/node.ts#L97Product
• https://github.com/withastro/astro/commit/dafbb1ba29912099c4faff1440033edc768af8b4Patch
• https://github.com/withastro/astro/security/advisories/GHSA-hr2q-hp5q-x767Exploit, Third Party Advisory

Published

Nov 13, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-6452A vulnerability was found in CodeAstro Patient Record Manage…4.8
• CVE-2025-64520GLPI is a free asset and IT management software package. Sta…4.3
• CVE-2025-64521authentik is an open-source Identity Provider. Prior to vers…4.8
• CVE-2025-64522Soft Serve is a self-hostable Git server for the command lin…7.6
• CVE-2025-64523File Browser provides a file managing interface within a spe…8.8
• CVE-2025-64524cups-filters contains backends, filters, and other software …5.5
• CVE-2025-64526Strapi is an open source headless content management system.…5.3
• CVE-2025-64527Envoy is a high-performance edge/middle/service proxy. In 1.…6.5
• CVE-2025-64528Discourse is an open source discussion platform. Prior to ve…5.3
• CVE-2025-64529SpiceDB is an open source database system for creating and m…6.5
• CVE-2025-6453A vulnerability classified as critical has been found in diy…4.3
• CVE-2025-64530Apollo Federation is an architecture for declaratively compo…7.5