VulnSocial

CVE-2025-64764Disclosure(astro / astro)

LOWCVSS 5.4 · MEDIUM

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft
  • Track advisory updates for patch or workaround availability

Recommended action window: High priority (within 72h)

NVD description

Astro is a web framework. Prior to version 5.15.8, a reflected XSS vulnerability is present when the server islands feature is used in the targeted application, regardless of what was intended by the component template(s). This issue has been patched in version 5.15.8.

astro CVEsBack to dashboard
1.5/ 10 priority

Sources & remediation

Patch / fix
Exploit / PoC references
Weakness type (CWE)
CWE-80

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • astro

Threat summary

  • Public PoC is present in monitored signal
  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • PoC mentioned or linked in 1 signal
  • Technical details provided in 2 signals
  • Disclosure: 2 classified signals
  • Peaked 1d ago at 1 mentions (2026-05-13); latest day: 1
  • 2 total mentions across 2 days

Affected systems

Vendors
astro
Products
astro

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-05-13: 1Mentions · 2026-08-04: 1PoC Mentioned / Linked · 2026-05-13: 1Technical Details · 2026-05-13: 1Technical Details · 2026-08-04: 105-1308-04
Signal classification1 categories
Disclosure
2100.0%
Referenced assets9 URLs
Full discourse2 posts
  • Marcin Dudek@MythThrazz
    Disclosure

    Here are the direct links to the most serious (High-severity) Astro CVEs: 1. CVE-2024-56159 (High) — Server source code exposure via sourcemaps NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-56159 GitHub Advisory: https://github.com/withastro/astro/security/advisories/GHSA-49w6-73cw-chjr 2. CVE-2025-64764 (High, CVSS 7.1) — Reflected XSS via server islands http://CVE.org: https://www.cve.org/CVERecord?id=CVE-2025-64764 NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-64764 GitHub Advisory: https://github.com/withastro/astro/security/advisories/GHSA-wrwg-2hg8-v723 3. CVE-2026-59731 (High, CVSS 8.2) — Authorization bypass (middleware path checks) Confirmed High in multiple trackers (Snyk, Hacktron, Release Alert) Related GitHub advisory: GHSA-vj59-8hwv-xxmv (searchable on the project’s security page) 4. CVE-2026-54299 (High, CVSS 7.5) — Host-header SSRF in prerendered error pages GitHub Advisory: https://github.com/withastro/astro/security/advisories/GHSA-2pvr-wf23-7pc7 5. CVE-2026-50146 (High, CVSS 7.1) — Reflected XSS via unescaped slot names Confirmed High in trackers and release notes Full official list of all Astro security advisories https://github.com/withastro/astro/security/advisories

    Post summary

    The text announces several high‑severity Astro CVEs, provides severity scores, vulnerability types, and links to official advisories.

    0001057
    1.7K followersView on X
  • DailyCVE@dailycve
    Disclosure

    🔵 Astro, AES-GCM Parameter Binding Bypass, #CVE-2025-64764 (Low) https://dailycve.com/astro-aes-gcm-parameter-binding-bypass-cve-2025-64764-low/

    Post summary

    Announcement of a low‑severity AES‑GCM Parameter Binding Bypass vulnerability in Astro (CVE‑2025‑64764), with a link to a detailed CVE entry.

    00000844
    203 followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appastroastro-node.js-

Explore more

Back to dashboardastro CVEsastro vulnerabilities