CVE-2025-58179 - CVE House

Back to Database

Status published High CVE-2025-58179

Astro Cloudflare adapter is vulnerable to Server-Side Request Forgery via /_image endpoint

7.2 CVSS

Vulnerability Description

Astro is a web framework for content-driven websites. Versions 11.0.3 through 12.6.5 are vulnerable to SSRF when using Astro's Cloudflare adapter. When configured with output: 'server' while using the default imageService: 'compile', the generated image optimization endpoint doesn't check the URLs it receives, allowing content from unauthorized third-party domains to be served. a A bug in impacted versions of the @astrojs/cloudflare adapter for deployment on Cloudflare’s infrastructure, allows an attacker to bypass the third-party domain restrictions and serve any content from the vulnerable origin. This issue is fixed in version 12.6.6.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-58179

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from withastro

View All →

Astro has an Authentication Bypass via Double URL Encoding, a bypass for CVE-2025-64765

Astro Cloudflare adapter has a Stored Cross Site Scripting vulnerability in /_image endpoint

Astro middleware authentication checks based on url.pathname can be bypassed via url encoded values

Astro is vulnerable to Reflected XSS via the server islands feature

Astro Development Server is Vulnerable to Arbitrary Local File Read

Affected Vendor

withastro

View all reports →

Affected Software

astro

Vulnerable Versions:

>= 11.0.3, < 12.6.6

Timeline

Official Publish: September 4th, 2025

Last Modified: September 5th, 2025

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1213 Data from Information Repositories

T1005 Data from Local System

T1046 Network Service Discovery