Withastro vulnerabilities
44 CVEs and advisories name Withastro as an affected vendor, newest first. Follow it as a feed.
- CVE-2025-64764Astro is vulnerable to Reflected XSS via the server islands feature
- CVE-2025-65019Astro Cloudflare adapter has a Stored Cross Site Scripting vulnerability in /_image endpoint
- CVE-2025-64757Astro Development Server is Vulnerable to Arbitrary Local File Read
- CVE-2025-64745Astro development server error page vulnerable to reflected Cross-site Scripting
- CVE-2025-64525Astro: URL manipulation via unsanitized headers leads to path-based middleware protections bypass, potential SSRF/cache-poisoning, CVE-2025-61925 bypass
- CVE-2025-59837astro allows bypass of image proxy domain validation leading to SSRF and potential XSS
- CVE-2025-61925Astro's `X-Forwarded-Host` is reflected with no validation
- CVE-2025-58179Astro Cloudflare adapter is vulnerable to Server-Side Request Forgery via /_image endpoint
- CVE-2025-55303Unauthorized third-party images in Astro’s _image endpoint
- CVE-2025-55207@astrojs/node's trailing slash handling causes open redirect issue
- CVE-2025-54793Astro: Duplicate trailing slash feature can lead to Open Redirects
- CVE-2024-56159Server source code is exposed to the public if sourcemaps are enabled
- CVE-2024-56140Bypass of CSRF Middleware in Astro
- CVE-2024-47885astro's client-side router has DOM Clobbering Gadget that leads to XSS