Server-Side Request Forgery (SSRF)

Astro is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to improperly anchored regular expressions used to validate Netlify Image CDN remote-image URLs, which allows an unauthenticated attacker to bypass host allowlists and cause the Image CDN to request...

GHSA-4233-JC72-56C5 Astro: Netlify Image CDN allowlist bypass enables SSRF

Summary The @astrojs/netlify adapter generated regular expressions for Netlify Image CDN remote-image allowlists without anchoring them to the beginning of the URL. Netlify evaluates these expressions with RegExp.test, so an allowed image origin appearing anywhere in a URL, including its path or...

Astro: Netlify Image CDN allowlist bypass enables SSRF

Summary The @astrojs/netlify adapter generated regular expressions for Netlify Image CDN remote-image allowlists without anchoring them to the beginning of the URL. Netlify evaluates these expressions with RegExp.test, so an allowed image origin appearing anywhere in a URL, including its path or...

@devtoti/archui-lib (>=1.0.9, <=1.1.0), @shawnsandy/astro-kit (0.1.0) +10 more potentially affected by CVE-2026-102983 via @astrojs/netlify (>=5.5.4, <=7.0.13)

@astrojs/netlify NPM version =5.5.4, =1.0.9, =2.4.0, =0.5.1, =0.3.0, =1.0.0, =1.3.1, =2.0.0, =2.0.10 - fulldev-ui 0.7.0 - www-v2 0.0.1 Source cves: CVE-2026-102983 Source advisory: OSV:GHSA-4233-JC72-56C5...

CVE-2026-102983

Astro is a web framework for content-driven websites. From 5.2.0 until 8.2.4, the @astrojs/netlify adapter generates regular expressions for Netlify Image CDN remote-image allowlists without anchoring them to the beginning of the URL. Because Netlify evaluates these expressions with RegExp.test, ...

Server-side Request Forgery (SSRF)

Overview @astrojs/netlify is a Deploy your site to Netlify Affected versions of this package are vulnerable to Server-side Request Forgery SSRF through a permissive regular expression in remotePatternToRegex and the image.domains mapping in remoteImagesFromAstroConfig in...

EUVD-2026-89969

Astro is a web framework for content-driven websites. From 5.2.0 until 8.2.4, the @astrojs/netlify adapter generates regular expressions for Netlify Image CDN remote-image allowlists without anchoring them to the beginning of the URL. Because Netlify evaluates these expressions with RegExp.test, ...

CVE-2026-102983

The @astrojs/netlify adapter for the Astro web framework (versions 5.2.0 through 8.2.4) is vulnerable to Server-Side Request Forgery (SSRF) . The root cause is that generated regular expressions for Netlify Image CDN remote-image allowlists lack anchoring to the beginning of the URL. This allows ...

CVE-2026-102983 Astro: Netlify Image CDN allowlist bypass enables SSRF

Astro is a web framework for content-driven websites. From 5.2.0 until 8.2.4, the @astrojs/netlify adapter generates regular expressions for Netlify Image CDN remote-image allowlists without anchoring them to the beginning of the URL. Because Netlify evaluates these expressions with RegExp.test, ...

CVE-2026-102983 Astro: Netlify Image CDN allowlist bypass enables SSRF

Astro is a web framework for content-driven websites. From 5.2.0 until 8.2.4, the @astrojs/netlify adapter generates regular expressions for Netlify Image CDN remote-image allowlists without anchoring them to the beginning of the URL. Because Netlify evaluates these expressions with RegExp.test, ...

CVE-2026-102983: Permissive Regular Expression

Astro is a web framework for content-driven websites. From 5.2.0 until 8.2.4, the @astrojs/netlify adapter generates regular expressions for Netlify Image CDN remote-image allowlists without anchoring them to the beginning of the URL. Because Netlify evaluates these expressions with RegExp.test, ...

PT-2026-103280

Astro is a web framework for content-driven websites. From 5.2.0 until 8.2.4, the @astrojs/netlify adapter generates regular expressions for Netlify Image CDN remote-image allowlists without anchoring them to the beginning of the URL. Because Netlify evaluates these expressions with RegExp.test, ...

PT-2026-105478

Summary The @astrojs/netlify adapter generated regular expressions for Netlify Image CDN remote-image allowlists without anchoring them to the beginning of the URL. Netlify evaluates these expressions with RegExp.test, so an allowed image origin appearing anywhere in a URL, including its path or...

MAL-2026-15564 Malicious code in vs-modules (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dcd50c73d1e9bbca9b707d80936562866b7469239c038a540c02a9f43efedb57 package.json declares a preinstall hook that runs node resources.js, which fires automatically on npm install. resources.js is heavily obfuscated wit...

CVE-2026-73425

Astro is a web framework for content-driven websites. Prior to 8.1.2, the Astro Netlify adapter converts each image.remotePatterns entry into a regular expression written to .netlify/v1/config.json under images.remoteimages for Netlify's Image CDN allowlist. In...

CVE-2026-73425 @astrojs/netlify generates an overly-broad Netlify Image CDN allowlist because remotePatterns.pathname metacharacters are not escaped

Astro is a web framework for content-driven websites. Prior to 8.1.2, the Astro Netlify adapter converts each image.remotePatterns entry into a regular expression written to .netlify/v1/config.json under images.remoteimages for Netlify's Image CDN allowlist. In...

CVE-2026-73425 @astrojs/netlify generates an overly-broad Netlify Image CDN allowlist because remotePatterns.pathname metacharacters are not escaped

Astro is a web framework for content-driven websites. Prior to 8.1.2, the Astro Netlify adapter converts each image.remotePatterns entry into a regular expression written to .netlify/v1/config.json under images.remoteimages for Netlify's Image CDN allowlist. In...

CVE-2026-73425 @astrojs/netlify generates an overly-broad Netlify Image CDN allowlist because remotePatterns.pathname metacharacters are not escaped

Astro is a web framework for content-driven websites. Prior to 8.1.2, the Astro Netlify adapter converts each image.remotePatterns entry into a regular expression written to .netlify/v1/config.json under images.remoteimages for Netlify's Image CDN allowlist. In...

CVE-2026-73425

CVE-2026-73425 affects Astro with the Netlify adapter prior to 8.1.2. The root cause is in remotePatternToRegex: dots in hostnames are escaped, but pathname metacharacters (., +, ?, (, [) are not escaped, so a restrictive pathname like /img/v1.0/file can match unintended paths. Netlify enforces t...

EUVD-2026-57610

Astro is a web framework for content-driven websites. Prior to 8.1.2, the Astro Netlify adapter converts each image.remotePatterns entry into a regular expression written to .netlify/v1/config.json under images.remoteimages for Netlify's Image CDN allowlist. In...