CVE-2025-55303: Astro Web Framework XSS Vulnerability

CVE-2025-55303 Overview

CVE-2025-55303 affects Astro, a web framework for content-driven websites. The vulnerability resides in the /_image optimization endpoint of Astro projects deployed with on-demand rendering. Attackers can bypass third-party domain restrictions by supplying a protocol-relative URL, such as /_image?href=//example.com/image.png, as the image source.

The flaw enables unauthorized third-party images to be served through the victim site's image proxy. Versions of Astro prior to 5.13.2 and 4.16.18 are affected. The maintainers fixed the issue in releases 5.13.2 and 4.16.18.

Critical Impact
Attackers can proxy arbitrary third-party images through the target Astro site, enabling content spoofing, bandwidth abuse, and low-integrity impact on downstream systems consuming the endpoint.

Affected Products

Astro versions prior to 4.16.18 (4.x branch)
Astro versions prior to 5.13.2 (5.x branch)
Astro projects deployed with on-demand rendering (Node.js SSR)

Discovery Timeline

2025-08-19 - CVE-2025-55303 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-55303

Vulnerability Analysis

Astro sites built with on-demand rendering expose an /_image endpoint that returns optimized versions of images. The endpoint enforces an allowlist of remote domains from which images may be fetched. The remote path check in packages/internal-helpers/src/path.ts used a regular expression that matched only explicit protocol prefixes such as http://, https://, ftp://, and ws://. Protocol-relative URLs beginning with // were not classified as remote paths, so they bypassed the domain allowlist validation while still being fetched as remote resources at request time. The weakness is tracked as [CWE-79] and affects integrity and confidentiality of served content at a limited scope.

Root Cause

The isRemotePath helper in packages/internal-helpers/src/path.ts failed to recognize protocol-relative URLs. The original regex /^(?:http|ftp|https|ws):?\/\// required an explicit scheme, so an input like //attacker.com/x.png returned false. Downstream logic then treated the value as a local path for allowlist purposes but resolved it as a remote fetch, producing the bypass.

Attack Vector

An attacker crafts a URL against a vulnerable Astro deployment such as https://victim.example/_image?href=//attacker.com/image.png. The endpoint fetches the image from attacker.com and serves it back through the victim's origin, effectively turning the site into an open image proxy for unauthorized domains.

typescript

// Patch: packages/internal-helpers/src/path.ts
/**
 * Regex that matches URLs like:
 * - http://example.com
 * - https://example.com
 * - ftp://example.com
 * - ws://example.com
 * - //example.com (protocol-relative URLs)
 */
const URL_PROTOCOL_REGEX = /^(?:(?:http|ftp|https|ws):?\/\/|\/\/)/;

export function isRemotePath(src: string) {
	return URL_PROTOCOL_REGEX.test(src) || src.startsWith('data:');
}

Source: Astro commit 4d16de7

Detection Methods for CVE-2025-55303

Indicators of Compromise

Requests to /_image containing an href parameter that begins with // followed by an external hostname.
Outbound HTTP fetches from the Astro server process to domains not present in the configured image.domains or image.remotePatterns allowlist.
Spikes in /_image traffic referencing hosts unrelated to the site's normal content sources.

Detection Strategies

Parse web server and CDN access logs for the pattern /_image?href=// and correlate against the allowlisted domains defined in astro.config.mjs.
Inspect egress traffic from Node.js SSR workers for connections to domains outside the expected image origin set.
Add a WAF rule that flags any href query parameter starting with // on the /_image route.

Monitoring Recommendations

Enable structured logging on the SSR runtime and forward /_image request parameters to a centralized log store.
Alert on repeated requests referencing the same external host, which indicates active abuse of the endpoint.
Track the running Astro version in build pipelines and fail builds that pin versions below 4.16.18 or 5.13.2.

How to Mitigate CVE-2025-55303

Immediate Actions Required

Upgrade Astro to 5.13.2 or 4.16.18 (or later) in all projects using on-demand rendering.
Audit access logs for prior abuse of /_image with protocol-relative href values.
Review and tighten the image.domains and image.remotePatterns configuration to the minimum set required.

Patch Information

The fix is committed in Astro commit 4d16de7 and documented in GHSA-xf8x-j4p2-f749. The patch updates isRemotePath to include protocol-relative URLs in the remote-path classification, forcing them through the domain allowlist check.

Workarounds

If immediate upgrade is not feasible, deploy a reverse proxy or WAF rule that rejects requests to /_image when the href parameter begins with //.
Disable on-demand image optimization by pre-building images at compile time until the patched version is deployed.
Restrict the SSR process egress via network policy so it cannot reach unapproved external hosts.

bash

# Upgrade Astro to a patched release
npm install astro@^5.13.2
# or, for the 4.x branch
npm install astro@^4.16.18

# Verify the installed version
npx astro --version