CVE-2025-64525
BaseFortify
Publication date: 2025-11-13
Last updated on: 2025-11-25
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| astro | astro | From 2.16.0 (inc) to 5.15.5 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-918 | The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability affects the Astro web framework versions 2.16.0 up to but excluding 5.15.5 that use on-demand rendering. It involves insecure use of the request headers 'x-forwarded-proto' and 'x-forwarded-port' without sanitization to build URLs. This can lead to several issues including bypassing middleware-based protected routes (via 'x-forwarded-proto'), denial of service through cache poisoning if a CDN is used, server-side request forgery (SSRF) via 'x-forwarded-proto', URL pollution which can cause stored cross-site scripting (SXSS) if a CDN is present, and bypassing web application firewalls (WAF). The vulnerability is fixed in version 5.15.5.
How can this vulnerability impact me? :
The vulnerability can impact you by allowing attackers to bypass protected routes in your application, potentially gaining unauthorized access. It can cause denial of service through cache poisoning if you use a CDN, leading to service disruption. Attackers may exploit SSRF to make unauthorized requests from your server. URL pollution can lead to stored cross-site scripting attacks, compromising user security. Additionally, attackers might bypass your web application firewall protections, increasing exposure to other attacks.
What immediate steps should I take to mitigate this vulnerability?
Upgrade Astro to version 5.15.5 or later, as this version contains a patch that fixes the vulnerability related to insecure use of the x-forwarded-proto and x-forwarded-port headers.