Remote URL Bypass Vulnerability in Astrojs Cloudflare SSR Adapter
CVE-2026-41321

2.2LOW

Key Information:

Vendor

Withastro

Status
@astrojs/cloudflare
Vendor
CVE Published:
24 April 2026

What is CVE-2026-41321?

The Astrojs Cloudflare SSR adapter faces a vulnerability that allows an attacker to exploit its fetch() call for remote images. Prior to version 13.1.10, the implementation adhered to a 'follow' behavior for HTTP redirects, enabling a Cloudflare Worker to follow these redirects to arbitrary URLs. This bypasses the isRemoteAllowed() domain allowlist verification, potentially leading to unauthorized access to content. This issue stems from an incomplete resolution of a previous vulnerability, requiring update to the recommended version to mitigate the risk.

Affected Version(s)

@astrojs/cloudflare < 13.1.10

References

https://github.com/withastro/astro/security/advisories/GH...
x_refsource_CONFIRM

CVSS V3.1

Score:
2.2
Severity:
LOW
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.