Server-side Request Forgery (SSRF) Affecting astro package, versions <5.15.5
Threat Intelligence
Snyk has a proof-of-concept or detailed explanation of how to exploit this vulnerability.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsSnyk Learn
Learn about Server-side Request Forgery (SSRF) vulnerabilities in an interactive lesson.
Start learning- Snyk IDSNYK-JS-ASTRO-13961342
- published14 Nov 2025
- disclosed13 Nov 2025
- creditcold-try
Introduced: 13 Nov 2025
NewCVE-2025-64525 (opens in a new tab)How to fix?
Upgrade astro to version 5.15.5 or higher.
Overview
astro is an Astro is a modern site builder with web best practices, performance, and DX front-of-mind.
Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) via the x-forwarded-proto and x-forwarded-port headers due to improper input sanitization when constructing URLs. An attacker can bypass path-based middleware protections, poison caches, or perform server-side requests by manipulating these headers.
Note:
This is also a bypass of the fix for CVE-2025-61925.