Skip to content
OpenAdvisories

Package · npm

@astrojs/cloudflare

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • Low 2.2
    CVE-2026-41321

    @astrojs/cloudflare: SSRF via redirect following in Cloudflare image-binding-transform endpoint

    @astrojs/cloudflare is an SSR adapter for use with Cloudflare Workers targets. Prior to 13.1.10, the fetch() call for remote images in packages/integrations/cloudflare/src/utils/image-binding-transform.ts uses the default redirect: 'follow' behavior. This all…

    withastro @astrojs/cloudflare @astrojs/cloudflare npm
  • High 7.2
    CVE-2025-58179 Public exploit Scanner template

    Astro Cloudflare adapter is vulnerable to Server-Side Request Forgery via /_image endpoint

    Astro is a web framework for content-driven websites. Versions 11.0.3 through 12.6.5 are vulnerable to SSRF when using Astro's Cloudflare adapter. When configured with output: 'server' while using the default imageService: 'compile', the generated image optim…

    withastro astro @astrojs/cloudflare npm