CVE-2025-58179CWE-918

Astro Cloudflare adapter is vulnerable to Server-Side Request Forgery via /_image endpoint

High · published September 4, 2025

CVSS v3.1
7.2
EPSS
1%
Percentile
58.4
In the wild
Unconfirmed
What it is

Astro is a web framework for content-driven websites. Versions 11.0.3 through 12.6.5 are vulnerable to SSRF when using Astro's Cloudflare adapter. When configured with output: 'server' while using the default imageService: 'compile', the generated image optimization endpoint doesn't check the URLs it receives, allowing content from unauthorized third-party domains to be served. a A bug in impacted versions of the @astrojs/cloudflare adapter for deployment on Cloudflare’s infrastructure, allows an attacker to bypass the third-party domain restrictions and serve any content from the vulnerable origin. This issue is fixed in version 12.6.6.

The record
Technical detail
CVSS v3.1
7.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00870 · 58.4th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2025-09-04T23:36Z
EPSS history
Timeline
  • 04 SEP 23:36Z
    Astro Cloudflare adapter is vulnerable to Server-Side Request Forgery via /_image endpoint
    cvelistv5