---
id: CVE-2025-61925
title: Astro is a web framework
summary: >-
  Astro is a web framework. Prior to version 5.14.2, Astro reflects the value in
  `X-Forwarded-Host` in output when using `Astro.url` without any validation. It
  is common for web servers such as nginx to route requests via the `Host`
  header…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L'
cwe:
  - CWE-470
vendor: astro
product: astro
affected:
  - astro < 5.14.2
patched:
  - astro 5.14.2
published: '2025-10-10'
updated: '2026-10-08'
sourceUpdated: '2026-10-08T13:10:00.200'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-61925'
references:
  - url: 'https://github.com/Chisnet/minimal_dynamic_astro_server'
    label: security-advisories@github.com
  - url: 'https://github.com/withastro/astro/security/advisories/GHSA-5ff5-9fcw-vg88'
    label: security-advisories@github.com
tags:
  - nvd
epss: 0.00408
epssPercentile: 0.32937
ingestedAt: '2026-10-08T13:42:55.086Z'
---

## Overview

Astro is a web framework. Prior to version 5.14.2, Astro reflects the value in `X-Forwarded-Host` in output when using `Astro.url` without any validation. It is common for web servers such as nginx to route requests via the `Host` header, and forward on other request headers. As such as malicious request can be sent with both a `Host` header and an `X-Forwarded-Host` header where the values do not match and the `X-Forwarded-Host` header is malicious. Astro will then return the malicious value. This could result in any usages of the `Astro.url` value in code being manipulated by a request. For example if a user follows guidance and uses `Astro.url` for a canonical link the canonical link can be manipulated to another site. It is theoretically possible that the value could also be used as a login/registration or other form URL as well, resulting in potential redirecting of login credentials to a malicious party. As this is a per-request attack vector the surface area would only be to the malicious user until one considers that having a caching proxy is a common setup, in which case any page which is cached could persist the malicious value for subsequent users. Many other frameworks have an allowlist of domains to validate against, or do not have a case where the headers are reflected to avoid such issues. This could affect anyone using Astro in an on-demand/dynamic rendering mode behind a caching proxy. Version 5.14.2 contains a fix for the issue.

## Affected

- `astro < 5.14.2`

## Remediation

Upgrade past the affected range:

- `astro 5.14.2`