CVE-2025-64757: 
JavaScript vulnerability analysis and mitigation

A vulnerability (CVE-2025-64757) has been identified in the Astro web framework's development server that allows arbitrary local file read access through the image optimization endpoint. The vulnerability was discovered and disclosed on November 19, 2025, affecting Astro versions prior to 5.14.3. The issue specifically impacts Astro development environments and allows remote attackers to read any image file accessible to the Node.js process on the host system (GitHub Advisory).

The vulnerability exists in the Node.js image endpoint handler during development mode. The endpoint accepts an href parameter that specifies the path to an image file, but in development mode, this parameter is processed without adequate path validation, allowing attackers to specify absolute file paths. The issue is located in packages/astro/src/assets/endpoint/node.ts where the development branch bypasses the security checks that exist in the production code path. The vulnerability has been assigned a CVSS v3.1 base score of 3.5 (Low) with the vector string CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N, indicating adjacent network attack vector, low attack complexity, no privileges required, and user interaction required (GitHub Advisory, NVD).

The vulnerability has a HIGH confidentiality impact as it allows unauthorized access to any image file readable by the Node.js process, with the complete file contents accessible via HTTP response transformed to PNG format. There is no integrity impact as the vulnerability only allows reading files, not modification. While there is no direct availability impact, there is potential for resource exhaustion through repeated large image requests (GitHub Advisory).

The vulnerability has been patched in Astro version 5.14.3. The fix involves moving the development server logic to a new file (packages/astro/src/assets/endpoint/dev.ts) and adding a check using isParentDirectory to ensure the requested file is within the project's root directory (GitHub Patch).