Security Flaw in Astro Adapter for Netlify by Astro
CVE-2026-54300

5.3MEDIUM

Key Information:

Vendor

Withastro

Status
Astro
Vendor
CVE Published:
22 June 2026

What is CVE-2026-54300?

The @astrojs/netlify adapter, which facilitates the deployment of Astro’s hybrid or server-rendered sites on Netlify, has been found to possess an input validation issue prior to version 7.0.13. This flaw occurs as the adapter converts Astro's image.remotePatterns into Netlify Image CDN images.remote_images, inadvertently applying broader semantics than intended. This can lead to unintended matches, such as a single wildcard hostname like .example.com being excessively permissive by allowing optional subdomain regex matches, and wildcard pathnames like /ok/ matching deeper paths due to the absence of end anchoring. The vulnerability was mitigated in version 7.0.13.

Affected Version(s)

astro < 7.0.13

References

https://github.com/withastro/astro/security/advisories/GH...
x_refsource_CONFIRM

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.