CVE-2025-58179: Astro Cloudflare Adapter Vulnerability Enables SSRF

CVE-2025-58179 is a high-severity vulnerability in the Astro Cloudflare adapter, affecting sites built with Astro when deployed on Cloudflare Pages or Workers using the default image service (CVSS 7.2). Exploitation could lead to Server-Side Request Forgery and, potentially, Cross-Site Scripting. The advisory explains that a bug in impacted versions of the @astrojs/cloudflare adapter allows bypassing third-party domain restrictions to serve content from the vulnerable origin. Researchers demonstrated the flaw with a minimal Astro project (astro@5.13.3) configured with the vulnerable Cloudflare adapter (@astrojs/cloudflare@12.6.5), where a crafted request could fetch content from an unauthorized domain, such as a placeholder image from placehold[.]co. The advisory confirms that this risk includes SSRF and, if a user follows a malicious URL, XSS and content injection possibilities. Developers are urged to upgrade to @astrojs/cloudflare v12.6.6 or later.