Patchfirst
Patchfirst
CVE-2025-58179 Public exploit High · 7.2 EPSS 0.9%

Astro Cloudflare adapter is vulnerable to Server-Side Request Forgery via /_image endpoint

withastro · astro

Official description · CVE.org

Astro is a web framework for content-driven websites. Versions 11.0.3 through 12.6.5 are vulnerable to SSRF when using Astro's Cloudflare adapter. When configured with output: 'server' while using the default imageService: 'compile', the generated image optimization endpoint doesn't check the URLs it receives, allowing content from unauthorized third-party domains to be served. a A bug in impacted versions of the @astrojs/cloudflare adapter for deployment on Cloudflare’s infrastructure, allows an attacker to bypass the third-party domain restrictions and serve any content from the vulnerable origin. This issue is fixed in version 12.6.6.

Breakdown
61.8 / 100
Exploited
Yes, in VulnCheck KEV
Reports
0
Tactics
0/15

Public exploit code (PoC-in-GitHub) appeared 2 months after disclosure. No confirmed exploitation is recorded.

  1. Disclosedday 0
  2. Public exploit codePoC-in-GitHub+2 mo

See the family tree

A fix was bypassed or incomplete 2 times over 8 months.

Same bug familyLinked by evidence that a fix failed or the same code was patched again. Oldest first.

  1. This CVECVE-2025-58179Astro Cloudflare adapter is vulnerable to Server-Side Request…4 Sep 2025
  2. incomplete fixHigh

    Why these are linked:

    • Stated in the CVE textThis vulnerability exists due to an incomplete fix for CVE-2025-58179.
    CVE-2025-59837astro allows bypass of image proxy domain validation leading to…28 Oct 2025
  3. same family
    CVE-2026-41321@astrojs/cloudflare: SSRF via redirect following in Cloudflare…24 Apr 2026

techniques

No techniques linked

No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: @astrojs/cloudflare.

npm@astrojs/cloudflareGHSA-qpr4-c339-7vq8

Upgrade to 12.6.6 or later

npmnpm install @astrojs/cloudflare@12.6.6

The first fix for CVE-2025-58179. No other CVE tracked by Patchfirst affects this package.

Affected versions

If you runUpgrade to
11.0.3 up to 12.6.612.6.6

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

References

2 links, grouped by NVD tag

x_refsource_CONFIRM 1

github.com/withastro/astro/security/advisories/GHSA-qpr4-c339-7vq8

x_refsource_MISC 1

github.com/withastro/astro/commit/9ecf3598e2b29dd74614328fde3047ea90e67252
↑ ↓ chooseEnter openEsc close