High severity · published Oct 28, 2025
CVE-2025-59837
astro allows bypass of image proxy domain validation leading to SSRF and potential XSS
7.2
CVSS
0.4%
EPSS
No
On KEV
Description
Astro is a web framework that includes an image proxy. In versions 5.13.4 and later before 5.13.10, the image proxy domain validation can be bypassed by using backslashes in the href parameter, allowing server-side requests to arbitrary URLs. This can lead to server-side request forgery (SSRF) and potentially cross-site scripting (XSS). This vulnerability exists due to an incomplete fix for CVE-2025-58179. Fixed in 5.13.10.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 29% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AS
astro · withastro
>= 5.13.4, < 5.13.10 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-59837
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-59837
Patch
https://github.com/withastro/astro/commit/1e2499e8ea83ebfa233a18a7499e1ccf169e56f4
Patch
https://github.com/withastro/astro/commit/9ecf3598e2b29dd74614328fde3047ea90e67252
Exploit
https://github.com/withastro/astro/security/advisories/GHSA-qcpr-679q-rhm2
More from astro
9.1
CVE-2026-33768
Astro: Unauthenticated Path Override via `x-astro-path` / `x_astro_path`
8.6
CVE-2026-25545
Astro has Full-Read SSRF in error rendering via Host: header injection
8.2
CVE-2026-102984
Astro: Malformed port in the Host header can crash the Node adapter
8.2
CVE-2026-59731
Astro 6.4.7 Authorization Bypass via Decode Iteration Limit and Rewrite Path Canonicalization Mismatch
7.5
CVE-2026-54299
Astro: Host-header full-read SSRF in core prerendered error-page fetch (prerenderedErrorPageFetch default + unvalidated createRequestFromNodeRequest URL)