Withastro Astro up to 8.1.1 Image index.ts remotePatternToRegex incorrect regex

Summaryinfo

A vulnerability was found in Withastro Astro up to 8.1.1. It has been rated as critical. This impacts the function remotePatternToRegex of the file packages/integrations/netlify/src/index.ts of the component Image Handler. Performing a manipulation results in incorrect regex. This vulnerability is reported as CVE-2026-73425. The attack is possible to be carried out remotely. No exploit exists.

Detailsinfo

A vulnerability classified as critical has been found in Withastro Astro up to 8.1.1. This affects the function remotePatternToRegex of the file packages/integrations/netlify/src/index.ts of the component Image Handler. The manipulation with an unknown input leads to a incorrect regex vulnerability. CWE is classifying the issue as CWE-185. The product specifies a regular expression in a way that causes data to be improperly matched or compared. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Astro is a web framework for content-driven websites. Prior to 8.1.2, the Astro Netlify adapter converts each image.remotePatterns entry into a regular expression written to .netlify/v1/config.json under images.remote_images for Netlify's Image CDN allowlist. In packages/integrations/netlify/src/index.ts, remotePatternToRegex() escapes dots in hostname values but interpolates literal pathname values without escaping regular expression metacharacters such as ., +, ?, (, and [, so a restrictive pathname such as /img/v1.0/file also matches metacharacter-adjacent paths, including paths that cross a segment. Netlify enforces the generated regular expression directly and Astro's matchPattern() helper does not revalidate the request, allowing optimization of images on an already-allowed host that the declared pathname was intended to exclude. This issue is fixed in version 8.1.2.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-73425 since 08/12/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details are known, but no exploit is available.

Upgrading to version 8.1.2 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• Withastro

Name

• Astro

Version

• 8.1.0
• 8.1.1

Website

• Product: https://github.com/withastro/astro/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion