Astro has an Authentication Bypass via Double URL Encoding, a bypass for CVE-2025-64765

Astro: URL manipulation via unsanitized headers leads to path-based middleware protections bypass, potential SSRF/cache-poisoning, CVE-2025-61925 bypass

Astro's `X-Forwarded-Host` is reflected with no validation

Bypass of CSRF Middleware in Astro

Astro: XSS via Unescaped Attribute Names in Spread Props

Astro: Reflected XSS via unescaped slot name

Astro: Server island encrypted parameters vulnerable to cross-component replay

Astro: XSS via incomplete `</script>` sanitization in `define:vars` allows case-insensitive and whitespace-based bypass

Astro Cloudflare adapter has a Stored Cross Site Scripting vulnerability in /_image endpoint

Astro development server error page vulnerable to reflected Cross-site Scripting

Unauthorized third-party images in Astro’s _image endpoint

Astro: Duplicate trailing slash feature can lead to Open Redirects

Astro is vulnerable to Reflected XSS via the server islands feature

The Astro web framework has a DOM Clobbering gadget in the client-side router starting in version 3.0.0 and prior to version 4.16.1

Astro: Remote allowlist bypass via unanchored matchPathname wildcard

Astro middleware authentication checks based on url.pathname can be bypassed via url encoded values

Server source code is exposed to the public if sourcemaps are enabled