CVE-2025-58179: SSRF in @astrojs/cloudflare Image Service

The SSRF vulnerability arises because the image optimization endpoint (/_image) in Astro sites, when configured with output: 'server' and imageService: 'compile', does not properly validate the URLs it receives. This lack of validation allows an attacker to craft malicious requests that instruct the server to fetch content from arbitrary external sources. An attacker could leverage this to access internal resources that are not directly exposed to the public internet, potentially revealing sensitive data or gaining unauthorized access to backend systems. The blast radius extends to any data accessible through HTTP/HTTPS requests from the server, depending on the permissions and network configuration of the Astro deployment.

1. Reserved2025-08-27
2. Published2025-09-04
3. Modified2025-09-05
4. EPSS updated2026-03-23

The primary mitigation for CVE-2025-58179 is to upgrade to @astrojs/cloudflare version 12.6.6 or later, which includes the necessary URL validation checks. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) or reverse proxy to filter incoming requests to the /image endpoint, blocking requests with suspicious or unauthorized domain names. Additionally, review and restrict network access for the Astro server to minimize the potential impact of a successful SSRF attack. After upgrading, confirm the fix by attempting to access the /image endpoint with a URL pointing to an external, unauthorized domain; the request should be rejected.