CVE-2025-61925

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-61925", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2025-10-03T22:21:59.616Z", "datePublished": "2025-10-10T19:34:05.142Z", "dateUpdated": "2025-10-10T20:01:06.836Z"}, "containers": {"cna": {"title": "Astro's `X-Forwarded-Host` is reflected with no validation", "problemTypes": [{"descriptions": [{"cweId": "CWE-470", "lang": "en", "description": "CWE-470: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/withastro/astro/security/advisories/GHSA-5ff5-9fcw-vg88", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/withastro/astro/security/advisories/GHSA-5ff5-9fcw-vg88"}, {"name": "https://github.com/Chisnet/minimal_dynamic_astro_server", "tags": ["x_refsource_MISC"], "url": "https://github.com/Chisnet/minimal_dynamic_astro_server"}], "affected": [{"vendor": "withastro", "product": "astro", "versions": [{"version": "< 5.14.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-10-10T19:34:05.142Z"}, "descriptions": [{"lang": "en", "value": "Astro is a web framework. Prior to version 5.14.2, Astro reflects the value in `X-Forwarded-Host` in output when using `Astro.url` without any validation. It is common for web servers such as nginx to route requests via the `Host` header, and forward on other request headers. As such as malicious request can be sent with both a `Host` header and an `X-Forwarded-Host` header where the values do not match and the `X-Forwarded-Host` header is malicious. Astro will then return the malicious value. This could result in any usages of the `Astro.url` value in code being manipulated by a request. For example if a user follows guidance and uses `Astro.url` for a canonical link the canonical link can be manipulated to another site. It is theoretically possible that the value could also be used as a login/registration or other form URL as well, resulting in potential redirecting of login credentials to a malicious party. As this is a per-request attack vector the surface area would only be to the malicious user until one considers that having a caching proxy is a common setup, in which case any page which is cached could persist the malicious value for subsequent users. Many other frameworks have an allowlist of domains to validate against, or do not have a case where the headers are reflected to avoid such issues. This could affect anyone using Astro in an on-demand/dynamic rendering mode behind a caching proxy. Version 5.14.2 contains a fix for the issue."}], "source": {"advisory": "GHSA-5ff5-9fcw-vg88", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-10T20:00:44.551372Z", "id": "CVE-2025-61925", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-10T20:01:06.836Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-61925", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-10T20:00:44.551372Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-10T20:00:58.281Z"}}], "cna": {"title": "Astro's `X-Forwarded-Host` is reflected with no validation", "source": {"advisory": "GHSA-5ff5-9fcw-vg88", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "withastro", "product": "astro", "versions": [{"status": "affected", "version": "< 5.14.2"}]}], "references": [{"url": "https://github.com/withastro/astro/security/advisories/GHSA-5ff5-9fcw-vg88", "name": "https://github.com/withastro/astro/security/advisories/GHSA-5ff5-9fcw-vg88", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/Chisnet/minimal_dynamic_astro_server", "name": "https://github.com/Chisnet/minimal_dynamic_astro_server", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Astro is a web framework. Prior to version 5.14.2, Astro reflects the value in `X-Forwarded-Host` in output when using `Astro.url` without any validation. It is common for web servers such as nginx to route requests via the `Host` header, and forward on other request headers. As such as malicious request can be sent with both a `Host` header and an `X-Forwarded-Host` header where the values do not match and the `X-Forwarded-Host` header is malicious. Astro will then return the malicious value. This could result in any usages of the `Astro.url` value in code being manipulated by a request. For example if a user follows guidance and uses `Astro.url` for a canonical link the canonical link can be manipulated to another site. It is theoretically possible that the value could also be used as a login/registration or other form URL as well, resulting in potential redirecting of login credentials to a malicious party. As this is a per-request attack vector the surface area would only be to the malicious user until one considers that having a caching proxy is a common setup, in which case any page which is cached could persist the malicious value for subsequent users. Many other frameworks have an allowlist of domains to validate against, or do not have a case where the headers are reflected to avoid such issues. This could affect anyone using Astro in an on-demand/dynamic rendering mode behind a caching proxy. Version 5.14.2 contains a fix for the issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-470", "description": "CWE-470: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-10-10T19:34:05.142Z"}}}, "cveMetadata": {"cveId": "CVE-2025-61925", "state": "PUBLISHED", "dateUpdated": "2025-10-10T20:01:06.836Z", "dateReserved": "2025-10-03T22:21:59.616Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2025-10-10T19:34:05.142Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "astro", "vendor": "withastro", "versions": [{"status": "affected", "version": "< 5.14.2"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:astro:astro:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "FFAAA369-C462-46C6-8029-8ADC566A1869", "versionEndExcluding": "5.14.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Astro is a web framework. Prior to version 5.14.2, Astro reflects the value in `X-Forwarded-Host` in output when using `Astro.url` without any validation. It is common for web servers such as nginx to route requests via the `Host` header, and forward on other request headers. As such as malicious request can be sent with both a `Host` header and an `X-Forwarded-Host` header where the values do not match and the `X-Forwarded-Host` header is malicious. Astro will then return the malicious value. This could result in any usages of the `Astro.url` value in code being manipulated by a request. For example if a user follows guidance and uses `Astro.url` for a canonical link the canonical link can be manipulated to another site. It is theoretically possible that the value could also be used as a login/registration or other form URL as well, resulting in potential redirecting of login credentials to a malicious party. As this is a per-request attack vector the surface area would only be to the malicious user until one considers that having a caching proxy is a common setup, in which case any page which is cached could persist the malicious value for subsequent users. Many other frameworks have an allowlist of domains to validate against, or do not have a case where the headers are reflected to avoid such issues. This could affect anyone using Astro in an on-demand/dynamic rendering mode behind a caching proxy. Version 5.14.2 contains a fix for the issue."}, {"lang": "es", "value": "Astro es un framework web. Antes de la versi\u00f3n 5.14.2, Astro refleja el valor en 'X-Forwarded-Host' en la salida al usar 'Astro.url' sin ninguna validaci\u00f3n. Es com\u00fan que los servidores web como nginx enruten las solicitudes a trav\u00e9s del encabezado 'Host' y reenv\u00eden otros encabezados de solicitud. Como tal, se puede enviar una solicitud maliciosa con un encabezado 'Host' y un encabezado 'X-Forwarded-Host' donde los valores no coinciden y el encabezado 'X-Forwarded-Host' es malicioso. Astro devolver\u00e1 entonces el valor malicioso. Esto podr\u00eda resultar en que cualquier uso del valor 'Astro.url' en el c\u00f3digo sea manipulado por una solicitud. Por ejemplo, si un usuario sigue las indicaciones y usa 'Astro.url' para un enlace can\u00f3nico, el enlace can\u00f3nico puede ser manipulado a otro sitio. Es te\u00f3ricamente posible que el valor tambi\u00e9n pueda usarse como una URL de inicio de sesi\u00f3n/registro u otra URL de formulario, lo que resultar\u00eda en el posible redireccionamiento de las credenciales de inicio de sesi\u00f3n a una parte maliciosa. Dado que este es un vector de ataque por solicitud, la superficie de ataque solo ser\u00eda para el usuario malicioso hasta que se considere que tener un proxy de almacenamiento en cach\u00e9 es una configuraci\u00f3n com\u00fan, en cuyo caso cualquier p\u00e1gina que se almacene en cach\u00e9 podr\u00eda persistir el valor malicioso para usuarios posteriores. Muchos otros frameworks tienen una lista de permitidos de dominios para validar, o no tienen un caso en el que los encabezados se reflejen para evitar tales problemas. Esto podr\u00eda afectar a cualquiera que use Astro en un modo de renderizado bajo demanda/din\u00e1mico detr\u00e1s de un proxy de almacenamiento en cach\u00e9. La versi\u00f3n 5.14.2 contiene una soluci\u00f3n para el problema."}], "id": "CVE-2025-61925", "lastModified": "2026-10-08T13:10:00.200", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 2.5, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-61925", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-10-10T20:00:44.551372Z", "version": "2.0.3"}}]}, "published": "2025-10-10T20:15:38.233", "references": [{"source": "security-advisories@github.com", "tags": ["Product"], "url": "https://github.com/Chisnet/minimal_dynamic_astro_server"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/withastro/astro/security/advisories/GHSA-5ff5-9fcw-vg88"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-470"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"created": "2025-10-20T16:17:14.210099+00:00", "updated": "2025-10-20T16:17:14.210132+00:00", "vendors": ["withastro", "withastro$PRODUCT$astro"]}