CVE-2025-61925

Published Oct 10, 2025

Last updated 7 months ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-61925 is a vulnerability in the Astro web framework prior to version 5.14.2. It stems from the application reflecting the value of the `X-Forwarded-Host` header without proper validation when using `Astro.url`. Web servers like Nginx often route requests via the `Host` header and forward other request headers. This allows an attacker to send a malicious request with a manipulated `X-Forwarded-Host` header, potentially redirecting canonical links or other URL-based functionality to a malicious site. The vulnerability can lead to issues such as canonical link manipulation and potential redirection of login credentials. While the attack initially affects only the malicious user, it can persist and affect subsequent users if the application is behind a caching proxy. A fix is available in Astro version 5.14.2, which implements proper validation of the `X-Forwarded-Host` header value. It's also possible to bypass the patch by sending an empty value in the `x-forwarded-host` header.

Description: Astro is a web framework. Prior to version 5.14.2, Astro reflects the value in `X-Forwarded-Host` in output when using `Astro.url` without any validation. It is common for web servers such as nginx to route requests via the `Host` header, and forward on other request headers. As such as malicious request can be sent with both a `Host` header and an `X-Forwarded-Host` header where the values do not match and the `X-Forwarded-Host` header is malicious. Astro will then return the malicious value. This could result in any usages of the `Astro.url` value in code being manipulated by a request. For example if a user follows guidance and uses `Astro.url` for a canonical link the canonical link can be manipulated to another site. It is theoretically possible that the value could also be used as a login/registration or other form URL as well, resulting in potential redirecting of login credentials to a malicious party. As this is a per-request attack vector the surface area would only be to the malicious user until one considers that having a caching proxy is a common setup, in which case any page which is cached could persist the malicious value for subsequent users. Many other frameworks have an allowlist of domains to validate against, or do not have a case where the headers are reflected to avoid such issues. This could affect anyone using Astro in an on-demand/dynamic rendering mode behind a caching proxy. Version 5.14.2 contains a fix for the issue.
Source: security-advisories@github.com
NVD status: Analyzed
Products: astro

Risk scores

CVSS 3.1

Type: Secondary
Base score: 6.5
Impact score: 2.5
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Severity: MEDIUM

Weaknesses

security-advisories@github.com: CWE-470

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:astro:astro:*:*:*:*:*:node.js:*:*",
            "matchCriteriaId": "FFAAA369-C462-46C6-8029-8ADC566A1869",
            "versionEndExcluding": "5.14.2",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.