CVE-2025-64745
Low · 2.7Astro development server error page vulnerable to reflected Cross-site Scripting
CVSS
2.7
EPSS
0.3%
Published
Nov 13, 2025
CISA due date
—
The record
A Reflected Cross-Site Scripting (XSS) vulnerability exists in Astro's development server error pages when the `trailingSlash` configuration option is used. An attacker can inject arbitrary JavaScript code that executes in the victim's browser context by crafting a malicious URL. While this vulnerability only affects the development server and not production builds, it could be exploited to compromise developer environments through social engineering or malicious links.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | astro | 5.2.0 | 5.15.6 |
Related vulnerabilities
- GHSA-w2vj-39qv-7vh7 Astro development server error page is vulnerable to reflected Cross-site Scripting Same vulnerability
- CVE-2026-54298 Astro is a web framework. Also affects astro
- CVE-2026-54299 Astro is a web framework. Also affects astro
- CVE-2026-50146 Astro is a web framework. Also affects astro
- GHSA-jrpj-wcv7-9fh9 Astro: XSS via Unescaped Attribute Names in Spread Props Also affects astro
- GHSA-2pvr-wf23-7pc7 Astro: Host header SSRF in prerendered error page fetch Also affects astro
- GHSA-8hv8-536x-4wqp Astro: Reflected XSS via unescaped slot name Also affects astro
- CVE-2026-45028 Astro is a web framework. Also affects astro