Homepage

Server-side Request Forgery (SSRF) Affecting @astrojs/cloudflare package, versions >=11.0.3 <12.6.6

Severity

 Recommended
0.0
medium
0
10

CVSS assessment by Snyk's Security Team. Learn more

Threat Intelligence

Exploit Maturity
Proof of Concept
EPSS
0.03% (6th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about Server-side Request Forgery (SSRF) vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDSNYK-JS-ASTROJSCLOUDFLARE-12496482
  • published5 Sept 2025
  • disclosed5 Sept 2025
  • creditWillow, Monish Basaniwal
Report a new vulnerability Found a mistake?

Introduced: 5 Sep 2025

NewCVE-2025-58179  (opens in a new tab)
CWE-918  (opens in a new tab)

How to fix?

Upgrade @astrojs/cloudflare to version 12.6.6 or higher.

Overview

@astrojs/cloudflare is a Deploy your site to Cloudflare Workers/Pages

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) via the /_image endpoint. An attacker can access internal or unauthorized resources by submitting crafted URLs to the generated image optimization endpoint configured with output: server and utilizing default imageService: compile.

PoC

  1. Create a new minimal Astro project (astro@5.13.3)

  2. Configure it to use the Cloudflare adapter (@astrojs/cloudflare@12.6.5) and server output:

// astro.config.mjs
import { defineConfig } from 'astro/config';
import cloudflare from '@astrojs/cloudflare';


export default defineConfig({
  output: 'server',
  adapter: cloudflare(),
});

  1. Deploy to Cloudflare Pages or Workers

  2. Append /_image?href=https://placehold.co/600x400 to the deployment URL.

  3. This will serve the placeholder image from the unauthorised placehold.co domain.

References

CVSS Base Scores

version 4.0
version 3.1