# CVE-2025-64525: Astro - XSS

> Live exploitation tracking for CVE-2025-64525 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2025-64525

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 6.5
- **Public exploit available:** Yes
- **Affected products:** WithAstro Astro
- **Weaknesses:** CWE-918 (Server-Side Request Forgery (SSRF))
- **Tags:** javascript

## Description

Astro is a web framework. In Astro versions 2.16.0 up to but excluding 5.15.5 which utilizeon-demand rendering, request headers `x-forwarded-proto` and `x-forwarded-port` are insecurely used, without sanitization, to build the URL. This has several consequences, the most important of which are: middleware-based protected route bypass (only via `x-forwarded-proto`), DoS via cache poisoning (if a CDN is present), SSRF (only via `x-forwarded-proto`), URL pollution (potential SXSS, if a CDN is present), and WAF bypass. Version 5.15.5 contains a patch.

## CrowdSec analysis

[CVE-2025-64525](https://euvd.enisa.europa.eu/vulnerability/CVE-2025-64525) is a vulnerability in Astro web framework versions 2.16.0 up to but excluding 5.15.5, where unsanitized use of the `x-forwarded-proto` and `x-forwarded-port` headers can allow attackers to bypass middleware protections, poison caches, perform SSRF attacks, pollute URLs, and evade web application firewalls. This flaw could be exploited remotely, especially in environments using CDNs, leading to potential denial of service or security policy bypasses. Upgrading to version 5.15.5 mitigates these risks.

CrowdSec has been tracking this vulnerability and its exploits since 10th of December 2025.

CrowdSec has not observed any significant exploitation activity targeting CVE-2025-64525 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers exploit this vulnerability by sending requests with crafted `x-forwarded-proto` headers, often targeting the root `/` endpoint, to bypass middleware protections and potentially trigger SSRF or other security bypasses.

## Timeline

- 2025-11-13: CVE Published. CVE-2025-64525 is published to NVD.
- 2025-12-10: Rule Released. CrowdSec releases a rule to detect CVE-2025-64525 exploitation attempts against the CrowdSec Network.

## References

- https://github.com/withastro/astro/security/advisories/GHSA-hr2q-hp5q-x767
- https://github.com/withastro/astro/blob/970ac0f51172e1e6bff4440516a851e725ac3097/packages/astro/src/core/app/node.ts#L121
- https://github.com/withastro/astro/commit/dafbb1ba29912099c4faff1440033edc768af8b4
- https://github.com/withastro/astro/blob/970ac0f51172e1e6bff4440516a851e725ac3097/packages/astro/src/core/app/node.ts#L97
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-64525.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2025-64525) follows observed exploitation activity for CVE-2025-64525. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.