Astro: Netlify Image CDN allowlist bypass enables SSRF

Summary The @astrojs/netlify adapter generated regular expressions for Netlify Image CDN remote-image allowlists without anchoring them to the beginning of the URL. Netlify evaluates these expressions with RegExp.test, so an allowed image origin appearing anywhere in a URL, including its path or...

Server-side Request Forgery (SSRF)

Overview @astrojs/netlify is a Deploy your site to Netlify Affected versions of this package are vulnerable to Server-side Request Forgery SSRF through a permissive regular expression in remotePatternToRegex and the image.domains mapping in remoteImagesFromAstroConfig in...

CVE-2026-27829: Server-Side Request Forgery (SSRF)

Astro is a web framework. In versions 9.0.0 through 9.5.3, a bug in Astro's image pipeline allows bypassing image.domains / image.remotePatterns restrictions, enabling the server to fetch content from unauthorized remote hosts. Astro provides an inferSize option that fetches remote images at rend...