Description

Astro is a web framework for content-driven websites. Prior to 8.1.2, the Astro Netlify adapter converts each image.remotePatterns entry into a regular expression written to .netlify/v1/config.json under images.remote_images for Netlify's Image CDN allowlist. In packages/integrations/netlify/src/index.ts, remotePatternToRegex() escapes dots in hostname values but interpolates literal pathname values without escaping regular expression metacharacters such as ., +, ?, (, and [, so a restrictive pathname such as /img/v1.0/file also matches metacharacter-adjacent paths, including paths that cross a segment. Netlify enforces the generated regular expression directly and Astro's matchPattern() helper does not revalidate the request, allowing optimization of images on an already-allowed host that the declared pathname was intended to exclude. This issue is fixed in version 8.1.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.7",
  "pubDate": "2026-08-12T21:17:41.473Z",
  "pubdate": "2026-08-12T21:17:41.473Z",
  "executiveSummary": "An improper neutralization of special elements in regular expressions exists in the Astro Netlify adapter prior to version 8.1.2. The vulnerability allows an attacker to bypass intended pathname restrictions within image optimization rules.\nThe affected product is the Astro web framework, specifically the Netlify adapter package. The risk implication involves unauthorized image optimization and potential exposure of server resources through overly broad Image CDN allowlist entries.\nAn attacker can exploit this flaw by supplying specially crafted pathname values containing unescaped regular expression metacharacters within image.remotePatterns configurations. This results in Netlify's Image CDN allowlist permitting paths that the developer explicitly intended to exclude.\nExploitation requires the ability to influence or configure remote patterns or leverage improperly constrained rules, leading to unauthorized image optimization on already-allowed hosts.",
  "technicalDetails": "The root cause of the vulnerability resides in packages/integrations/netlify/src/index.ts, specifically within the remotePatternToRegex() function. This function is responsible for converting image.remotePatterns entries into regular expressions that are written to .netlify/v1/config.json under the images.remote_images configuration key for Netlify's Image CDN allowlist.\nWhile remotePatternToRegex() correctly escapes dots in hostname values, it interpolates literal pathname values directly without properly escaping regular expression metacharacters such as '.', '+', '?', '(', and '['. For example, a restrictive pathname intended to match a specific directory structure like /img/v1.0/file is incorrectly compiled into a regex that matches metacharacter-adjacent paths, including paths that cross directory segments.\nNetlify enforces the generated regular expression directly upon incoming image optimization requests. Furthermore, Astro's matchPattern() helper does not perform subsequent revalidation of the request against the original intended pattern. Consequently, requests targeting paths that should be restricted are allowed if they match the flawed regular expression.\nThe attack flow proceeds as follows: 1) A configuration containing an unescaped pathname in image.remotePatterns is processed by the vulnerable remotePatternToRegex() function; 2) The resulting unescaped regular expression is serialized into .netlify/v1/config.json; 3) Netlify deploys the configuration and uses the flawed regex to evaluate incoming Image CDN requests; 4) An attacker crafts an HTTP request targeting a path that bypasses the intended segment boundary restrictions; 5) Netlify evaluates the request against the overly permissive regular expression and optimizes images from hosts or paths that were supposed to be excluded."
}