p PatchFirst

CVE-2025-64764

CVE-2025-64764 · Astro is vulnerable to Reflected XSS via the server islands feature

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Astro is a web framework. Prior to version 5.15.8, a reflected XSS vulnerability is present when the server islands feature is used in the targeted application, regardless of what was intended by the component template(s). This issue has been patched in version 5.15.8.

CVSS 7.1 · High · EPSS 0.5% · Public exploit · Fix available

Published
Updated

Stack: node

Affected products and versions

  • astro

    Versions
    • < 5.15.8: Affected

    No fix published

  • astro npm

    Affected ranges
    • SEMVER: < 5.15.8

    Update to 5.15.8

Original sources

Check your server →