CVE-2025-64525

Unknown Unknown - Not Provided

BaseFortify

Publication date: 2025-11-13

Last updated on: 2025-11-25

Assigner: GitHub, Inc.

Description

Astro is a web framework. In Astro versions 2.16.0 up to but excluding 5.15.5 which utilizeon-demand rendering, request headers `x-forwarded-proto` and `x-forwarded-port` are insecurely used, without sanitization, to build the URL. This has several consequences, the most important of which are: middleware-based protected route bypass (only via `x-forwarded-proto`), DoS via cache poisoning (if a CDN is present), SSRF (only via `x-forwarded-proto`), URL pollution (potential SXSS, if a CDN is present), and WAF bypass. Version 5.15.5 contains a patch.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-11-13

Last Modified

2025-11-25

Generated

2026-07-06

AI Q&A

2025-11-13

EPSS Evaluated

2026-07-05

NVD

CVE-2025-64525

EUVD

EUVD-2025-175298

Affected Vendors & Products

Vendor	Product	Version / Range
astro	astro	From 2.16.0 (inc) to 5.15.5 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

This vulnerability affects the Astro web framework versions 2.16.0 up to but excluding 5.15.5 that use on-demand rendering. It involves insecure use of the request headers 'x-forwarded-proto' and 'x-forwarded-port' without sanitization to build URLs. This can lead to several issues including bypassing middleware-based protected routes (via 'x-forwarded-proto'), denial of service through cache poisoning if a CDN is used, server-side request forgery (SSRF) via 'x-forwarded-proto', URL pollution which can cause stored cross-site scripting (SXSS) if a CDN is present, and bypassing web application firewalls (WAF). The vulnerability is fixed in version 5.15.5.

Impact Analysis

The vulnerability can impact you by allowing attackers to bypass protected routes in your application, potentially gaining unauthorized access. It can cause denial of service through cache poisoning if you use a CDN, leading to service disruption. Attackers may exploit SSRF to make unauthorized requests from your server. URL pollution can lead to stored cross-site scripting attacks, compromising user security. Additionally, attackers might bypass your web application firewall protections, increasing exposure to other attacks.

Mitigation Strategies

Upgrade Astro to version 5.15.5 or later, as this version contains a patch that fixes the vulnerability related to insecure use of the x-forwarded-proto and x-forwarded-port headers.

Hi! I’m here to help you understand CVE-2025-64525. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70