# Astro astro@5.15.5 — Release & Upgrade Intelligence
- **Product:** Astro (https://astro.build)
- **Version:** astro@5.15.5
- **Released:** Nov 10, 2025
- **Impact Score:** 5/10
- **Breaking Changes:** Not verified
- **Canonical Analysis:** https://changelogs.us/astro/updates/astro-5.15.5/

## Executive Summary (TL;DR)
Astro astro@5.15.5. Source highlight: Fixes a case where build's `process.env` would be inlined in the server output

## Bug Fixes
- Fixes a case where build's `process.env` would be inlined in the server output
- Improves fallbacks generation when using the experimental Fonts API
- Improves `X-Forwarded` header validation to prevent cache poisoning and header injection attacks. Now properly validates `X-Forwarded-Proto`, `X-Forwarded-Host`, and `X-Forwarded-Port` headers against configured `allowedDomains` patterns, rejecting malformed or suspicious values. This is especially important when running behind a reverse proxy or load balancer.

## Upgrade Command
```bash
npm install --save-exact astro@5.15.5
```