CVE-2026-25545
MediumPublic exploitAstro has Full-Read SSRF in error rendering via Host: header injection
Published Feb 23, 2026 · Updated Aug 12, 2026 · Also known as GHSA-qq67-mvv5-fw3g
Key Facts
Routine patching- CVE-2026-25545 is a medium-severity vulnerability (CVSS 6.9 v4) affecting \@astrojs\/node (Astro), @astrojs/node (npm), withastro/astro (github-repo) and 1 more product.
- It is not listed in any known-exploited vulnerabilities catalog. Public exploit code is available.
- EPSS estimates a 2.0% probability of exploitation in the next 30 days.
- Fixed versions are available, including @astrojs/node >= 9.5.4, @astrojs/node 9.5.4, \@astrojs\/node 9.5.4.
- Brandefense priority: routine patching, as no exploitation is known and its severity is moderate or low.
CVSS v4
6.9
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS (30-day exploit likelihood)
2.0%
Higher than 80.2% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
Available
Proof-of-concept or weaponized module
Get the full CVE-2026-25545 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
Astro is a web framework. Prior to version 9.5.4, Server-Side Rendered pages that return an error with a prerendered custom error page (eg. 404.astro or 500.astro) are vulnerable to SSRF. If the Host: header is changed to an attacker's server, it will be fetched on /500.html and they can redirect this to any internal URL to read the response body through the first request. An attacker who can access the application without Host: header validation (eg. through finding the origin IP behind a proxy, or just by default) can fetch their own server to redirect to any internal IP. With this they can fetch cloud metadata IPs and interact with services in the internal network or localhost. For this to be vulnerable, a common feature needs to be used, with direct access to the server (no proxies). Version 9.5.4 fixes the issue.
Affected Products
4 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| \@astrojs\/nodeAstro | See advisory | 9.5.4 |
| @astrojs/nodenpm | See advisory | 9.5.4 |
| withastro/astrogithub-repo | See advisory | n/a |
| astro | >= < 9.5.4 | n/a |
Patched Releases
@astrojs/node
>= 9.5.4, 9.5.4
\@astrojs\/node
9.5.4
Timeline
Publicly disclosed
Feb 23, 2026
Last updated
Aug 12, 2026
Weakness Type
- CWE-918 Server-Side Request Forgery (SSRF)
References
- advisoryGHSA advisory
- advisoryhttps://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25545.json
- advisoryhttps://nvd.nist.gov/vuln/detail/CVE-2026-25545
- articlehttps://docs.astro.build/en/basics/astro-pages/#custom-500-error-page
- articlehttps://github.com/withastro/astro/commit/e01e98b063e90d274c42130ec2a60cc0966622c9
FAQ
Common Questions.
Astro is a web framework.
Affected: \@astrojs\/node (Astro); @astrojs/node (npm); withastro/astro (github-repo), among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Public exploit code is available.
Fixed versions are available, including @astrojs/node >= 9.5.4, @astrojs/node 9.5.4, \@astrojs\/node 9.5.4.
Brandefense priority: routine patching, as no exploitation is known and its severity is moderate or low.
Is CVE-2026-25545 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo