CVE-2025-58179: Server-Side Request Forgery via /_image endpoint in Astro Cloudflare adapter

September 4, 2025 (updated September 5, 2025)

When using Astro’s Cloudflare adapter (@astrojs/cloudflare) configured with output: 'server' while using the default imageService: 'compile', the generated image optimization endpoint doesn’t check the URLs it receives, allowing content from unauthorized third-party domains to be served.

References

github.com/advisories/GHSA-qpr4-c339-7vq8
github.com/withastro/astro
github.com/withastro/astro/commit/9ecf3598e2b29dd74614328fde3047ea90e67252
github.com/withastro/astro/security/advisories/GHSA-qpr4-c339-7vq8
nvd.nist.gov/vuln/detail/CVE-2025-58179

Code Behaviors & Features

Detect and mitigate CVE-2025-58179 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →