Skip to content
OpenAdvisories

Package · npm

@astrojs/netlify

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

  • Medium 6.3
    CVE-2026-102983

    Astro: Netlify Image CDN allowlist bypass enables SSRF

    Astro is a web framework for content-driven websites. From 5.2.0 until 8.2.4, the @astrojs/netlify adapter generates regular expressions for Netlify Image CDN remote-image allowlists without anchoring them to the beginning of the URL. Because Netlify evaluate…

    withastro @astrojs astro netlify npm
  • Low 3.7
    CVE-2026-73425

    @astrojs/netlify generates an overly-broad Netlify Image CDN allowlist because remotePatterns.pathname metacharacters are not escaped

    Astro is a web framework for content-driven websites. Prior to 8.1.2, the Astro Netlify adapter converts each image.remotePatterns entry into a regular expression written to .netlify/v1/config.json under images.remote_images for Netlify's Image CDN allowlist.…

    withastro astro @astrojs/netlify npm
  • Medium 5.3
    CVE-2026-54300

    @astrojs/netlify broadens Astro image.remotePatterns in Netlify Image CDN config

    @astrojs/netlify is an adapter that allows Astro to deploy your hybrid or server rendered site to Netlify. Prior to 7.0.13, @astrojs/netlify converts Astro image.remotePatterns into Netlify Image CDN images.remote_images regular expressions with broader seman…

    withastro astro @astrojs/netlify npm