{"id":"CVE-2026-102983","summary":"Astro: Netlify Image CDN allowlist bypass enables SSRF","details":"Astro is a web framework for content-driven websites. From 5.2.0 until 8.2.4, the @astrojs/netlify adapter generates regular expressions for Netlify Image CDN remote-image allowlists without anchoring them to the beginning of the URL. Because Netlify evaluates these expressions with RegExp.test(), an allowed origin appearing only in a source URL's path or query can satisfy image.domains or image.remotePatterns while the URL's actual host remains attacker-controlled. An unauthenticated request to the public /.netlify/images endpoint can therefore cause the Image CDN to request attacker-selected URLs and may probe or reach internal services. Netlify egress protections may constrain reachable targets, and image transformation limits direct response exfiltration; no confidentiality or integrity impact has been demonstrated. This issue is fixed in version 8.2.4.","aliases":["GHSA-4233-jc72-56c5"],"modified":"2026-10-02T03:47:25.989324174Z","published":"2026-09-30T14:32:03.861Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102983.json","cna_assigner":"GitHub_M","cwe_ids":["CWE-625","CWE-918"]},"references":[{"type":"WEB","url":"https://github.com/withastro/astro/releases/tag/@astrojs/netlify@8.2.4"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102983.json"},{"type":"ADVISORY","url":"https://github.com/withastro/astro/security/advisories/GHSA-4233-jc72-56c5"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102983"},{"type":"FIX","url":"https://github.com/withastro/astro/commit/e362d4cf540b27730482455c8fc02efe57d16702"},{"type":"FIX","url":"https://github.com/withastro/astro/pull/17752"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/withastro/astro","events":[{"introduced":"f7283e07c8c4f3ffca28e5e0621e126c7ff31eb9"},{"fixed":"e362d4cf540b27730482455c8fc02efe57d16702"}],"database_specific":{"extracted_events":[{"introduced":"5.2.0"},{"fixed":"8.2.4"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["astro@7.2.4","@astrojs/vercel@11.0.7","@astrojs/react@6.0.4","@astrojs/preact@6.0.4","@astrojs/node@11.1.4","@astrojs/netlify@8.2.3","@astrojs/mdx@7.0.7","@astrojs/markdown-satteri@0.3.7","@astrojs/markdown-remark@7.2.4","@astrojs/markdoc@2.0.8","@astrojs/internal-helpers@0.10.4","@astrojs/cloudflare@14.2.3","astro@7.2.3","@astrojs/vercel@11.0.6","@astrojs/ts-plugin@1.10.11","@astrojs/react@6.0.3","@astrojs/preact@6.0.3","@astrojs/node@11.1.3","@astrojs/netlify@8.2.2","@astrojs/mdx@7.0.6","@astrojs/markdown-satteri@0.3.6","@astrojs/markdown-remark@7.2.3","@astrojs/markdoc@2.0.7","@astrojs/internal-helpers@0.10.3","@astrojs/cloudflare@14.2.2","astro@7.2.2","@astrojs/node@11.1.2","astro@7.2.1","@astrojs/underscore-redirects@1.0.4","@astrojs/node@11.1.1","@astrojs/netlify@8.2.1","@astrojs/language-server@2.16.14","@astrojs/cloudflare@14.2.1","astro@7.2.0","@astrojs/vue@7.0.2","@astrojs/vercel@11.0.5","@astrojs/upgrade@0.7.4","@astrojs/solid-js@7.0.2","@astrojs/node@11.1.0","@astrojs/netlify@8.2.0","@astrojs/cloudflare@14.2.0","astro@7.1.6","@astrojs/cloudflare@14.1.7","astro@7.1.5","astro-vscode@2.16.18","@astrojs/vercel@11.0.4","@astrojs/react@6.0.2","@astrojs/preact@6.0.2","@astrojs/node@11.0.3","@astrojs/netlify@8.1.3","@astrojs/mdx@7.0.5","@astrojs/markdown-satteri@0.3.5","@astrojs/markdown-remark@7.2.2","@astrojs/markdoc@2.0.6","@astrojs/internal-helpers@0.10.2","@astrojs/cloudflare@14.1.6","create-astro@5.2.3","astro@7.1.4","@astrojs/mdx@7.0.4","@astrojs/markdoc@2.0.5","@astrojs/cloudflare@14.1.5","@astrojs/check@0.9.10","@astrojs/markdoc@2.0.4","@astrojs/language-server@2.16.13","astro@7.1.3","@astrojs/cloudflare@14.1.4","astro@7.1.2","astro@7.1.1","astro@7.1.0","astro@7.0.9","@astrojs/vercel@11.0.3","astro@7.0.8","@astrojs/netlify@8.1.2","@astrojs/mdx@7.0.3","@astrojs/markdown-satteri@0.3.4","@astrojs/language-server@2.16.12","@astrojs/cloudflare@14.1.3","astro@7.0.7","@astrojs/telemetry@3.3.3","@astrojs/cloudflare@14.1.2","create-astro@5.2.2","astro@7.0.6","@astrojs/vercel@11.0.2","@astrojs/ts-plugin@1.10.10","@astrojs/solid-js@7.0.1","@astrojs/react@6.0.1","@astrojs/preact@6.0.1","@astrojs/node@11.0.2","@astrojs/netlify@8.1.1","@astrojs/mdx@7.0.2","@astrojs/markdown-satteri@0.3.3","@astrojs/markdown-remark@7.2.1","@astrojs/markdoc@2.0.3","@astrojs/language-server@2.16.11","@astrojs/internal-helpers@0.10.1","@astrojs/cloudflare@14.1.1","astro@7.0.5","astro-vscode@2.16.17","@astrojs/vue@7.0.1","@astrojs/vercel@11.0.1","@astrojs/svelte@9.0.1","@astrojs/node@11.0.1","@astrojs/netlify@8.1.0","@astrojs/mdx@7.0.1","@astrojs/markdoc@2.0.2","@astrojs/cloudflare@14.1.0","create-astro@5.2.1","astro@7.0.4","@astrojs/rss@4.0.19","@astrojs/cloudflare@14.0.2","create-astro@5.2.0","astro@7.0.3","@astrojs/upgrade@0.7.3","@astrojs/markdoc@2.0.1","@astrojs/cloudflare@14.0.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-102983.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}]}