Cross-Site Scripting Vulnerability in Astro Web Framework with Cloudflare Adapter

CVE-2025-65019

What is CVE-2025-65019?

The Astro web framework, specifically when utilizing the Cloudflare adapter (@astrojs/cloudflare) with an output setting of 'server', was found to have a serious vulnerability prior to version 5.15.9. This occurred in the image optimization endpoint (/_image), where the isRemoteAllowed() function improperly permitted data: protocol URLs. As a result, this flaw opened the door for Cross-Site Scripting (XSS) attacks by allowing the execution of malicious SVG payloads without adhering to the specified domain restrictions and undermining Content Security Policy protections. The vulnerability has been addressed and patched in version 5.15.9.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References