CVE-2025-55303: Astro allows unauthorized third-party images in _image endpoint

August 19, 2025 (updated November 27, 2025)

In affected versions of astro, the image optimization endpoint in projects deployed with on-demand rendering allows images from unauthorized third-party domains to be served.

References

github.com/advisories/GHSA-xf8x-j4p2-f749
github.com/withastro/astro
github.com/withastro/astro/commit/4d16de7f95db5d1ec1ce88610d2a95e606e83820
github.com/withastro/astro/security/advisories/GHSA-xf8x-j4p2-f749
nvd.nist.gov/vuln/detail/CVE-2025-55303

Code Behaviors & Features

Detect and mitigate CVE-2025-55303 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →