Vulnerability in Astro's @astrojs/netlify Adapter Affecting Remote Image Handling

CVE-2026-102983

What is CVE-2026-102983?

The @astrojs/netlify adapter in Astro, ranging from versions 5.2.0 to 8.2.4, contains an improper input validation vulnerability. It generates regular expressions for handling remote image URLs without properly anchoring them to the beginning of the input URL. As a result, malicious entities can exploit this flaw by crafting specific source URLs that can satisfy image domain or pattern checks, despite the actual host being under their control. This may lead to unauthorized access to internal services through unauthenticated requests to Netlify's public endpoint, although protections exist that limit the reach of such exploits. The issue has been resolved in version 8.2.4.

References