Server-side Request Forgery (SSRF)

Overview @astrojs/netlify is a Deploy your site to Netlify Affected versions of this package are vulnerable to Server-side Request Forgery SSRF through a permissive regular expression in remotePatternToRegex and the image.domains mapping in remoteImagesFromAstroConfig in...

CVE-2026-73425

CVE-2026-73425 affects Astro with the Netlify adapter prior to 8.1.2. The root cause is in remotePatternToRegex: dots in hostnames are escaped, but pathname metacharacters (., +, ?, (, [) are not escaped, so a restrictive pathname like /img/v1.0/file can match unintended paths. Netlify enforces t...