withastro Astro up to 8.2.3 Netlify Adapter RegExp.test incorrect regex

Summaryinfo

A vulnerability classified as problematic has been found in withastro Astro up to 8.2.3. Impacted is the function RegExp.test of the component Netlify Adapter. Performing a manipulation results in incorrect regex. This vulnerability is identified as CVE-2026-102983. The attack can be initiated remotely. There is not any exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, was found in withastro Astro up to 8.2.3. This affects the function RegExp.test of the component Netlify Adapter. The manipulation with an unknown input leads to a incorrect regex vulnerability. CWE is classifying the issue as CWE-185. The product specifies a regular expression in a way that causes data to be improperly matched or compared. This is going to have an impact on availability. The summary by CVE is:

Astro is a web framework for content-driven websites. From 5.2.0 until 8.2.4, the @astrojs/netlify adapter generates regular expressions for Netlify Image CDN remote-image allowlists without anchoring them to the beginning of the URL. Because Netlify evaluates these expressions with RegExp.test(), an allowed origin appearing only in a source URL's path or query can satisfy image.domains or image.remotePatterns while the URL's actual host remains attacker-controlled. An unauthenticated request to the public /.netlify/images endpoint can therefore cause the Image CDN to request attacker-selected URLs and may probe or reach internal services. Netlify egress protections may constrain reachable targets, and image transformation limits direct response exfiltration; no confidentiality or integrity impact has been demonstrated. This issue is fixed in version 8.2.4.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-102983 since 09/29/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 8.2.4 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• withastro

Name

• Astro

Version

• 8.2.0
• 8.2.1
• 8.2.2
• 8.2.3

Website

• Product: https://github.com/withastro/astro/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion