CVE-2026-25545: Astro-nomical Screw Up: Full-Read SSRF via Host Header Injection

Astro-nomical Screw Up: Full-Read SSRF via Host Header Injection Vulnerability ID: CVE-2026-25545 CVSS Score: 6.9 Published: 2026-02-23 Astro, the darling framework of the static site generation world, stumbled into a classic web security pitfall: trusting the client. In versions prior to 9.5.4, Astro's Server-Side Rendering (SSR) engine blindly trusted the HTTP Host header when fetching custom error pages. By poisoning this header, an attacker can trick the server into fetching resources from an external domain. The kicker? The internal fetch mechanism follows redirects by default. This turns a simple error page rendering process into a proxy for accessing internal network resources, local services, or cloud metadata endpoints. TL;DR Astro < 9.5.4 allows attackers to poison the Host header. When the server renders a custom error page (like 404.astro), it fetches the page using that poisoned host. Because the fetch follows redirects, attackers can bounce the request to internal IPs (SS