Remote Pattern Regex Escaping Flaw in Astro Web Framework by Astro
CVE-2026-73425

3.7LOW

Key Information:

Vendor

Withastro

Status
Astro
Vendor
CVE Published:
12 August 2026

What is CVE-2026-73425?

Astro, a web framework designed for content-driven websites, has a vulnerability in its Netlify adapter affecting versions before 8.1.2. The issue arises from the improper escaping of metacharacters in pathname values while converting image.remotePatterns entries into regular expressions for the Netlify Image CDN allowlist. This flaw allows for excessive matches, as the adapter fails to restrict requests effectively. Consequently, optimization may occur on paths that should be excluded based on the original configuration. This vulnerability is resolved in version 8.1.2.

Affected Version(s)

astro < 8.1.2

References

https://github.com/withastro/astro/security/advisories/GH...
x_refsource_CONFIRM

CVSS V3.1

Score:
3.7
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.