Packages / astro / Security

ModerateVulnerabilityGHSA-hr2q-hp5q-x767Published 13 Nov 2025

Astro vulnerable to URL manipulation via headers, leading to middleware and CVE-2025-61925 bypass

Affected · astro

  • >= 2.16.0, < 5.15.5

Fixed in

5.15.5

npm install astro@5.15.5

  1. Not affected

    0.0.1 – 2.10.15

    320 releases

  2. Affected

    3.0.0 – 5.15.4

    301 releases

  3. Fixed

    5.15.5 – 7.4.1

    109 releases, latest

730 stable releases of astro, oldest to newest.

What happens

The full text is not stored yet. Read it on osv.dev.