CVE

CVE-2025-64525

6.5

CVSSmedium

Exploitable remotely over the internet · no authentication required.

Description

Astro is a web framework. In Astro versions 2.16.0 up to but excluding 5.15.5 which utilizeon-demand rendering, request headers `x-forwarded-proto` and `x-forwarded-port` are insecurely used, without sanitization, to build the URL. This has several consequences, the most important of which are: middleware-based protected route bypass (only via `x-forwarded-proto`), DoS via cache poisoning (if a CDN is present), SSRF (only via `x-forwarded-proto`), URL pollution (potential SXSS, if a CDN is present), and WAF bypass. Version 5.15.5 contains a patch.

Attack Vector

Network

Privileges Req.

None

User Interaction

None

astro

Updated Sep 18, 2026View on NVD →

S4E scanner

mediumProduct Based Web Vulnerabilities~10 seconds

Astro - Broken Access Control

Astro 2.16.0 to 5.15.5 contains a broken access control caused by insecure use of unsanitized x-forwarded-proto and x-forwarded-port headers in URL building, letting attackers bypass middleware protection, cause DoS, SSRF, and URL pollution, exploit requires crafted headers. References: https://github.com/advisories/GHSA-hr2q-hp5q-x767 https://zhero-web-sec.github.io/research-and-things/astro-framework-and-standards-weaponization Remediation: Update to version 5.15.5 or later.

Used 2.4k times · domain, subdomain, ipv4

Scanner page →Run scanner

CVE history: astro

Predict next CVE date with AI

Monitor this CVE on your assets

S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.

Create a free account →