Description
Astro is a web framework for content-driven websites. In versions of astro before 5.13.2 and 4.16.18, the image optimization endpoint in projects deployed with on-demand rendering allows images from unauthorized third-party domains to be served. On-demand rendered sites built with Astro include an /_image endpoint which returns optimized versions of images. A bug in impacted versions of astro allows an attacker to bypass the third-party domain restrictions by using a protocol-relative URL as the image source, e.g. /_image?href=//example.com/image.png. This vulnerability is fixed in 5.13.2 and 4.16.18.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| withastro | astro | >= 5.0.0-alpha.0, < 5.13.2, < 4.16.18 | — |
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Astro - Unauthorized Third-Party Image Access http/cves/2025/CVE-2025-55303.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | @astrojs/node | < 9.1.1 | 9.1.1 | GHSA-xf8x-j4p2-f749 |
| npm | astro | >= 5.0.0-alpha.0, < 5.13.2 | 5.13.2 | GHSA-xf8x-j4p2-f749 |
| npm | astro | < 4.16.19 | 4.16.19 | GHSA-xf8x-j4p2-f749 |