CVE-2025-64757
Low · 3.5Astro Development Server has Arbitrary Local File Read
CVSS
3.5
EPSS
0.4%
Published
Nov 19, 2025
CISA due date
—
The record
A vulnerability has been identified in the Astro framework's development server that allows arbitrary local file read access through the image optimization endpoint. The vulnerability affects Astro development environments and allows remote attackers to read any image file accessible to the Node.js process on the host system.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | astro | 0 | 5.14.3 |
Related vulnerabilities
- GHSA-x3h8-62x9-952g Astro Development Server has Arbitrary Local File Read Same vulnerability
- CVE-2026-54298 Astro is a web framework. Also affects astro
- CVE-2026-54299 Astro is a web framework. Also affects astro
- CVE-2026-50146 Astro is a web framework. Also affects astro
- GHSA-jrpj-wcv7-9fh9 Astro: XSS via Unescaped Attribute Names in Spread Props Also affects astro
- GHSA-2pvr-wf23-7pc7 Astro: Host header SSRF in prerendered error page fetch Also affects astro
- GHSA-8hv8-536x-4wqp Astro: Reflected XSS via unescaped slot name Also affects astro
- CVE-2026-45028 Astro is a web framework. Also affects astro