CVE-2026-25545

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

Astro, a web framework for building sites, is affected by a server-side request forgery vulnerability in versions prior to 9.5.4. The flaw occurs in server-side rendered pages that use prerendered custom error pages such as 404.astro or 500.astro. When the Host header is supplied by an untrusted source, the framework fetches content from that header value while serving the error page, allowing an attacker to supply a redirect that reaches internal URLs and returns their response bodies to the original request.

An attacker who can reach the Astro application directly, for example by discovering its origin IP behind a proxy or when no Host validation is present, can exploit the issue by pointing the Host header at a server they control. That server issues a redirect to any internal IP address or localhost service, enabling the attacker to retrieve cloud-instance metadata, interact with internal network endpoints, or read responses that would otherwise be inaccessible. The attack requires no authentication and succeeds when the common custom-error-page feature is enabled.

The vulnerability is resolved in Astro 9.5.4. The project advisory and accompanying commit in the withastro/astro repository describe the SSRF vector and confirm that the patched release prevents the Host header from being used to fetch attacker-controlled redirects during error-page rendering. The associated EPSS scores remain low, with a current value of 0.0514 and a peak of 0.0611.