Astro - XSS (CVE-2025-64525)

CVE-2025-64525 is a vulnerability in Astro web framework versions 2.16.0 up to but excluding 5.15.5, where unsanitized use of the x-forwarded-proto and x-forwarded-port headers can allow attackers to bypass middleware protections, poison caches, perform SSRF attacks, pollute URLs, and evade web application firewalls. This flaw could be exploited remotely, especially in environments using CDNs, leading to potential denial of service or security policy bypasses. Upgrading to version 5.15.5 mitigates these risks.

CrowdSec has been tracking this vulnerability and its exploits since 10th of December 2025.

CrowdSec has not observed any significant exploitation activity targeting CVE-2025-64525 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers exploit this vulnerability by sending requests with crafted x-forwarded-proto headers, often targeting the root / endpoint, to bypass middleware protections and potentially trigger SSRF or other security bypasses.