Remote Code Execution in Astro Netlify Adapter

Publication date: 2026-08-12

Last updated on: 2026-08-12

Assigner: GitHub, Inc.

Description

Astro is a web framework for content-driven websites. Prior to 8.1.2, the Astro Netlify adapter converts each image.remotePatterns entry into a regular expression written to .netlify/v1/config.json under images.remote_images for Netlify's Image CDN allowlist. In packages/integrations/netlify/src/index.ts, remotePatternToRegex() escapes dots in hostname values but interpolates literal pathname values without escaping regular expression metacharacters such as ., +, ?, (, and [, so a restrictive pathname such as /img/v1.0/file also matches metacharacter-adjacent paths, including paths that cross a segment. Netlify enforces the generated regular expression directly and Astro's matchPattern() helper does not revalidate the request, allowing optimization of images on an already-allowed host that the declared pathname was intended to exclude. This issue is fixed in version 8.1.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-12

Last Modified

2026-08-12

Generated

2026-08-13

AI Q&A

2026-08-13

EPSS Evaluated

N/A

NVD

CVE-2026-73425

Affected Vendors & Products

Vendor	Product	Version / Range
astro	astro	to 8.1.2 (exc)
netlify	netlify_adapter	to 8.1.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-185	The product specifies a regular expression in a way that causes data to be improperly matched or compared.

Attack-Flow Graph

Executive Summary

This vulnerability affects the Astro framework's Netlify adapter before version 8.1.2. When converting image.remotePatterns entries to a regular expression for Netlify's Image CDN allowlist, the adapter escapes dots in hostnames but fails to escape metacharacters like ., +, ?, (, and [ in pathnames. This allows unintended path matches, potentially permitting image optimization on hosts or paths not intended to be allowed.

Impact Analysis

If you use Astro with the Netlify adapter before version 8.1.2, an attacker could exploit this to access image optimization on unintended hosts or paths. This might lead to unauthorized resource usage or data exposure if sensitive paths are matched incorrectly.

Mitigation Strategies

Upgrade Astro to version 8.1.2 or later to address the regex pattern issue in the Netlify adapter. Review .netlify/v1/config.json for unintended image path allowances and adjust remotePatterns in Astro configuration to ensure proper regex escaping.

Hi! I’m here to help you understand CVE-2026-73425. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70