CVE-2025-64757: Astro Development Server has Arbitrary Local File Read

November 19, 2025

A vulnerability has been identified in the Astro framework’s development server that allows arbitrary local file read access through the image optimization endpoint. The vulnerability affects Astro development environments and allows remote attackers to read any image file accessible to the Node.js process on the host system.

References

github.com/advisories/GHSA-x3h8-62x9-952g
github.com/withastro/astro
github.com/withastro/astro/commit/b8ca69b97149becefaf89bf21853de9c905cdbb7
github.com/withastro/astro/security/advisories/GHSA-x3h8-62x9-952g
nvd.nist.gov/vuln/detail/CVE-2025-64757

Code Behaviors & Features

Detect and mitigate CVE-2025-64757 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →