@devtoti/archui-lib (>=1.0.9, <=1.1.0), @shawnsandy/astro-kit (0.1.0) +10 more potentially affected by CVE-2026-102983 via @astrojs/netlify (>=5.5.4, <=7.0.13)

@astrojs/netlify NPM version =5.5.4, =1.0.9, =2.4.0, =0.5.1, =0.3.0, =1.0.0, =1.3.1, =2.0.0, =2.0.10 - fulldev-ui 0.7.0 - www-v2 0.0.1 Source cves: CVE-2026-102983 Source advisory: GHSA-4233-JC72-56C5...

Astro: Netlify Image CDN allowlist bypass enables SSRF

Summary The @astrojs/netlify adapter generated regular expressions for Netlify Image CDN remote-image allowlists without anchoring them to the beginning of the URL. Netlify evaluates these expressions with RegExp.test, so an allowed image origin appearing anywhere in a URL, including its path or...

@devtoti/archui-lib (>=1.0.9, <=1.1.0), @shawnsandy/astro-kit (0.1.0) +10 more potentially affected by CVE-2026-102983 via @astrojs/netlify (>=5.5.4, <=7.0.13)

@astrojs/netlify NPM version =5.5.4, =1.0.9, =2.4.0, =0.5.1, =0.3.0, =1.0.0, =1.3.1, =2.0.0, =2.0.10 - fulldev-ui 0.7.0 - www-v2 0.0.1 Source cves: CVE-2026-102983 Source advisory: OSV:GHSA-4233-JC72-56C5...

GHSA-4233-JC72-56C5 Astro: Netlify Image CDN allowlist bypass enables SSRF

Summary The @astrojs/netlify adapter generated regular expressions for Netlify Image CDN remote-image allowlists without anchoring them to the beginning of the URL. Netlify evaluates these expressions with RegExp.test, so an allowed image origin appearing anywhere in a URL, including its path or...

CVE-2026-102983

Astro is a web framework for content-driven websites. From 5.2.0 until 8.2.4, the @astrojs/netlify adapter generates regular expressions for Netlify Image CDN remote-image allowlists without anchoring them to the beginning of the URL. Because Netlify evaluates these expressions with RegExp.test, ...

@devtoti/archui-lib (>=1.0.9, <=1.1.0), @shawnsandy/astro-kit (0.1.0) +10 more potentially affected by CVE-2026-102983 via @astrojs/netlify (>=5.5.4, <=7.0.13)

@astrojs/netlify NPM version =5.5.4, =1.0.9, =2.4.0, =0.5.1, =0.3.0, =1.0.0, =1.3.1, =2.0.0, =2.0.10 - fulldev-ui 0.7.0 - www-v2 0.0.1 Source cves: CVE-2026-102983 Source advisory: SNYK:JS-ASTROJSNETLIFY-20419250...

Server-side Request Forgery (SSRF)

Overview @astrojs/netlify is a Deploy your site to Netlify Affected versions of this package are vulnerable to Server-side Request Forgery SSRF through a permissive regular expression in remotePatternToRegex and the image.domains mapping in remoteImagesFromAstroConfig in...

CVE-2026-102983 Astro: Netlify Image CDN allowlist bypass enables SSRF

Astro is a web framework for content-driven websites. From 5.2.0 until 8.2.4, the @astrojs/netlify adapter generates regular expressions for Netlify Image CDN remote-image allowlists without anchoring them to the beginning of the URL. Because Netlify evaluates these expressions with RegExp.test, ...

CVE-2026-102983 Astro: Netlify Image CDN allowlist bypass enables SSRF

Astro is a web framework for content-driven websites. From 5.2.0 until 8.2.4, the @astrojs/netlify adapter generates regular expressions for Netlify Image CDN remote-image allowlists without anchoring them to the beginning of the URL. Because Netlify evaluates these expressions with RegExp.test, ...

CVE-2026-102983

The @astrojs/netlify adapter for the Astro web framework (versions 5.2.0 through 8.2.4) is vulnerable to Server-Side Request Forgery (SSRF) . The root cause is that generated regular expressions for Netlify Image CDN remote-image allowlists lack anchoring to the beginning of the URL. This allows ...

EUVD-2026-89969

Astro is a web framework for content-driven websites. From 5.2.0 until 8.2.4, the @astrojs/netlify adapter generates regular expressions for Netlify Image CDN remote-image allowlists without anchoring them to the beginning of the URL. Because Netlify evaluates these expressions with RegExp.test, ...

PT-2026-103280

Astro is a web framework for content-driven websites. From 5.2.0 until 8.2.4, the @astrojs/netlify adapter generates regular expressions for Netlify Image CDN remote-image allowlists without anchoring them to the beginning of the URL. Because Netlify evaluates these expressions with RegExp.test, ...

CVE-2026-102983: Permissive Regular Expression

Astro is a web framework for content-driven websites. From 5.2.0 until 8.2.4, the @astrojs/netlify adapter generates regular expressions for Netlify Image CDN remote-image allowlists without anchoring them to the beginning of the URL. Because Netlify evaluates these expressions with RegExp.test, ...

PT-2026-105478

Summary The @astrojs/netlify adapter generated regular expressions for Netlify Image CDN remote-image allowlists without anchoring them to the beginning of the URL. Netlify evaluates these expressions with RegExp.test, so an allowed image origin appearing anywhere in a URL, including its path or...

@ayco/cozy (>=0.1.3, <=0.2.3), @devtoti/archui-lib (>=1.0.9, <=1.1.0) +11 more potentially affected by CVE-2026-73425 via @astrojs/netlify (>=2.6.0, <=7.0.13)

@astrojs/netlify NPM version =2.6.0, =0.1.3, =1.0.9, =2.4.0, =0.5.1, =0.3.0, =1.0.0, =1.3.1, =2.0.0, =2.0.10 - fulldev-ui 0.7.0 - www-v2 0.0.1 Source cves: CVE-2026-73425 Source advisory: MEND:CVE-2026-73425...

CVE-2026-73425 @astrojs/netlify generates an overly-broad Netlify Image CDN allowlist because remotePatterns.pathname metacharacters are not escaped

Astro is a web framework for content-driven websites. Prior to 8.1.2, the Astro Netlify adapter converts each image.remotePatterns entry into a regular expression written to .netlify/v1/config.json under images.remoteimages for Netlify's Image CDN allowlist. In...

Incorrect Regular Expression

Overview @astrojs/netlify is a Deploy your site to Netlify Affected versions of this package are vulnerable to Incorrect Regular Expression in the remotePatternToRegex process. An attacker can access unintended image URLs on the allowed host by crafting requests that exploit unescaped regex...

CVE-2026-54300

@astrojs/netlify is an adapter that allows Astro to deploy your hybrid or server rendered site to Netlify. Prior to 7.0.13, @astrojs/netlify converts Astro image.remotePatterns into Netlify Image CDN images.remoteimages regular expressions with broader semantics than Astro's canonical matcher. A...

@ayco/cozy (>=0.1.3, <=0.2.3), @devtoti/archui-lib (>=1.0.9, <=1.1.0) +11 more potentially affected by CVE-2026-54300 via @astrojs/netlify (>=2.6.0, <=6.6.5)

@astrojs/netlify NPM version =2.6.0, =0.1.3, =1.0.9, =2.4.0, =0.5.1, =0.3.0, =1.0.0, =1.3.1, =2.0.0, =2.0.10 - fulldev-ui 0.7.0 - www-v2 0.0.1 Source cves: CVE-2026-54300 Source advisory: MEND:CVE-2026-54300...

EUVD-2026-38334

@astrojs/netlify is an adapter that allows Astro to deploy your hybrid or server rendered site to Netlify. Prior to 7.0.13, @astrojs/netlify converts Astro image.remotePatterns into Netlify Image CDN images.remoteimages regular expressions with broader semantics than Astro's canonical matcher. A...