{"action":"Upgrade astro to 5.15.5 or later.","affected":[{"fixed":"5.15.5","introduced":"2.16.0"}],"component":"astro","cve_ids":["CVE-2025-64525"],"ecosystem":"npm","epss":0.01245,"exploited":false,"fixed_versions":["5.15.5"],"ghsa_id":"GHSA-hr2q-hp5q-x767","id":"tcs_01M5KFVX52TY86NZHHF6HC7X8X","modified_at":"2025-11-13T22:46:24Z","published_at":"2025-11-13T22:46:24Z","references":["https://osv.dev/vulnerability/GHSA-hr2q-hp5q-x767","https://github.com/withastro/astro/security/advisories/GHSA-hr2q-hp5q-x767","https://nvd.nist.gov/vuln/detail/CVE-2025-64525","https://github.com/withastro/astro/commit/dafbb1ba29912099c4faff1440033edc768af8b4","https://github.com/withastro/astro","https://github.com/withastro/astro/blob/970ac0f51172e1e6bff4440516a851e725ac3097/packages/astro/src/core/app/node.ts#L121","https://github.com/withastro/astro/blob/970ac0f51172e1e6bff4440516a851e725ac3097/packages/astro/src/core/app/node.ts#L97"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"GHSA-hr2q-hp5q-x767","url":"https://osv.dev/vulnerability/GHSA-hr2q-hp5q-x767"}],"summary":"Astro vulnerable to URL manipulation via headers, leading to middleware and CVE-2025-61925 bypass"}