CVE-2026-25545 - Vulnerability Analysis

Overview

Astro < 9.5.4 contains a server-side request forgery caused by improper Host header validation in prerendered custom error pages, letting attackers fetch internal URLs and read responses, exploit requires direct server access without proxy.

Severity & Score

Impact

Attackers can read internal network resources and cloud metadata by redirecting requests, potentially exposing sensitive internal data.

Mitigation

Upgrade to version 9.5.4 or later.

References

• https://github.com/withastro/astro/commit/e01e98b063e90d274c42130ec2a60cc0966622c9
• https://github.com/withastro/astro/releases/tag/%40astrojs%2Fnode%409.5.4
• https://github.com/withastro/astro/security/advisories/GHSA-qq67-mvv5-fw3g

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner