Astro versions from 2.16.0 up to but not including 5.15.5 are vulnerable to URL manipulation via unsanitized use of the x-forwarded-proto and x-forwarded-port headers in on-demand rendering. This flaw allows attackers to bypass middleware protections on routes, cause denial of service through cache poisoning, perform SSRF attacks, pollute URLs potentially leading to stored cross-site scripting, and bypass web application firewalls. The vulnerability arises because these headers are directly used to construct URLs without validation, enabling attackers to rewrite URLs arbitrarily. A proof of concept demonstrates bypassing middleware route protection by manipulating the protocol header to alter the URL path parsing. A fix is available in version 5.15.5.