CVE-2026-102983 in Astro
Summary
by MITRE • 09/30/2026
Astro is a web framework for content-driven websites. From 5.2.0 until 8.2.4, the @astrojs/netlify adapter generates regular expressions for Netlify Image CDN remote-image allowlists without anchoring them to the beginning of the URL. Because Netlify evaluates these expressions with RegExp.test(), an allowed origin appearing only in a source URL's path or query can satisfy image.domains or image.remotePatterns while the URL's actual host remains attacker-controlled. An unauthenticated request to the public /.netlify/images endpoint can therefore cause the Image CDN to request attacker-selected URLs and may probe or reach internal services. Netlify egress protections may constrain reachable targets, and image transformation limits direct response exfiltration; no confidentiality or integrity impact has been demonstrated. This issue is fixed in version 8.2.4.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/30/2026
The vulnerability identified in the Astro web framework specifically affects the @astrojs/netlify adapter used for deploying content-driven websites to Netlify infrastructure. The core technical flaw lies in how regular expressions are generated and evaluated for remote-image allowlists, which define trusted origins for image processing. In versions ranging from 5.2.0 through 8.2.4, these regular expressions were constructed without anchoring them to the beginning of the URL string using standard anchors such as caret symbols or equivalent logic in the regex engine. This oversight creates a significant logical error where pattern matching is not restricted to the hostname portion of a Uniform Resource Identifier but instead allows matches anywhere within the entire path and query parameters.
When Netlify processes image requests, it utilizes the RegExp.test() method to validate whether an incoming request originates from an allowed domain. Because the regular expressions lack proper anchoring at the start of the string, an attacker can craft URLs where a legitimate or whitelisted origin appears later in the URL path or within query parameters rather than as the actual host. For instance, if an allowlist permits example.com, a maliciously constructed URL might contain example.com in its path segment while pointing to a completely different and potentially internal or attacker-controlled domain as the true source of the image data. The validation logic incorrectly interprets this partial match as valid, thereby bypassing the intended security controls designed to restrict external resource fetching.
The operational impact of this vulnerability is primarily centered on server-side request forgery capabilities against Netlify's Image CDN service. An unauthenticated attacker can send requests to the public /.netlify/images endpoint with crafted parameters that exploit this regex flaw. This allows the attacker to force the image processing pipeline to fetch resources from arbitrary URLs, including internal network services or other infrastructure components that are not intended to be publicly accessible. While Netlify's egress protections and sandboxing mechanisms may limit the specific targets reachable by these forged requests, the ability to probe internal networks remains a serious concern for organizations relying on strict network segmentation and zero-trust architectures.
Although no direct confidentiality or integrity impact has been demonstrated in public disclosures due to the constraints imposed by Netlify’s infrastructure safeguards, such as image transformation limits that hinder response exfiltration, the potential for unauthorized access probing persists. This vulnerability aligns with CWE-20 Improper Input Validation and falls under MITRE ATT&CK technique T1589, which involves Gathering Victim Identity Information through network reconnaissance. The lack of strict input validation on domain allowlists represents a classic case where logical flaws in security controls can be exploited to bypass intended restrictions.
To mitigate this risk, organizations using Astro with the Netlify adapter must upgrade immediately to version 8.2.4 or later, which includes fixes for these regular expression anchoring issues. Until an upgrade is feasible, administrators should implement strict input validation at a reverse proxy level if possible and review existing image domain allowlists to ensure they do not rely on patterns that could be satisfied by non-host components of URLs. Additionally, monitoring logs for unusual requests directed at the /.netlify/images endpoint can help detect potential exploitation attempts in real-time.