p PatchFirst

CVE-2025-64745

CVE-2025-64745 · Astro development server error page vulnerable to reflected Cross-site Scripting

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Astro is a web framework. Starting in version 5.2.0 and prior to version 5.15.6, a Reflected Cross-Site Scripting (XSS) vulnerability exists in Astro's development server error pages when the `trailingSlash` configuration option is used. An attacker can inject arbitrary JavaScript code that executes in the victim's browser context by crafting a malicious URL. While this vulnerability only affects the development server and not production builds, it could be exploited to compromise developer environments through social engineering or malicious links. Version 5.15.6 fixes the issue.

CVSS 2.7 · Low · EPSS 0.3% · Fix available

Published
Updated

Stack: node

Affected products and versions

  • astro

    Versions
    • >= 5.2.0, < 5.15.6: Affected

    No fix published

  • astro npm

    Affected ranges
    • SEMVER: ≥ 5.2.0, < 5.15.6

    Update to 5.15.6

Original sources

Check your server →