high·Web Vulnerabilities·Updated Sep 18, 2025

Astro Cloudflare Adapter - Server Side Request Forgery

Run This Scanner →

Est. Time~10 seconds

Scan TypeGroup Scan

Targetsurl

CostFree

2.9k

Times Used

continuous scan runs

Continuously Checked

assets under CS

Vulnerabilities Found

confirmed findings

References

github.com↗

CVECVE-2025-58179

7.2

CVSShigh

Exploitable remotely over the internet · no authentication required.

Description

Astro is a web framework for content-driven websites. Versions 11.0.3 through 12.6.5 are vulnerable to SSRF when using Astro's Cloudflare adapter. When configured with output: 'server' while using the default imageService: 'compile', the generated image optimization endpoint doesn't check the URLs it receives, allowing content from unauthorized third-party domains to be served. a A bug in impacted versions of the @astrojs/cloudflare adapter for deployment on Cloudflare’s infrastructure, allows an attacker to bypass the third-party domain restrictions and serve any content from the vulnerable origin. This issue is fixed in version 12.6.6.

Attack Vector

Network

Privileges Req.

None

User Interaction

None

Affected

astroby withastro

>= 11.0.3, < 12.6.6

Updated Sep 18, 2026View on NVD →

Similar Tools

Check your infrastructure.
Right now.

11,000+ scanners. Free to start. No credit card required.

Run This Scanner →Browse All Tools

Astro Cloudflare Adapter - Server Side Request Forgery

Check your infrastructure.Right now.

Check your infrastructure.
Right now.