-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| astro | npm | < 5.14.3 | 5.14.3 |
Miggo AIRoot Cause AnalysisThe vulnerability (CVE-2025-61925) stems from an improper input validation of the X-Forwarded-Host header in Astro's server-side rendering mode. An attacker could send a crafted request with a malicious X-Forwarded-Host header, causing the server to generate URLs pointing to an external, malicious domain. This could be exploited for cache poisoning or to redirect users and their data.
The analysis of the provided patch commit 6ee63bfac4856f21b4d4633021b3d2ee059e553f pinpoints the exact code locations where the vulnerability existed.
App.render in packages/astro/src/core/app/index.ts: This is a fundamental method for handling server-side rendering in Astro. The diff shows that the code was changed to stop unconditionally trusting the X-Forwarded-Host header. The vulnerable version directly assigned the header's value to the host variable. The patched version introduces a validation step using this.matchesAllowedDomains.
NodeApp.createRequest in packages/astro/src/core/app/node.ts: This method is specific to the Astro Node.js adapter and is responsible for creating a standard Request object from a Node.js IncomingMessage. The vulnerability report explicitly mentions the node adapter. The patch shows that this method previously extracted the x-forwarded-host header and used it as the hostname without validation. The fix involves calling the new App.validateForwardedHost static method to verify the hostname against a list of allowed domains before it is used.
Both functions were directly processing the untrusted X-Forwarded-Host header and would be on the execution path during an exploit. Identifying these functions is critical for security engineers to understand the runtime indicators of this vulnerability.