Is CVE-2026-27829 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-27829 being exploited in the wild.

How severe is CVE-2026-27829?

Low severity, with a CVSS score of 3.1, published 25 February 2026.

Which products and versions are affected?

@astrojs/node (npm) SEMVER:introduced=9.0.0,fixed=9.5.4.

Is there a fix for CVE-2026-27829?

Yes. @astrojs/node (npm): upgrade to 9.5.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-27829 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-27829?

Check whether you run @astrojs/node (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-27829: Astro SSRF in remote image inferSize

CVE-2026-27829 · Severity: low · CVSS 3.1 · Published 2026-02-25

Astro's image processing feature includes an option to automatically fetch remote images to determine their dimensions. A flaw in this feature bypasses the developer's configured domain restrictions, allowing an attacker to trick the server into fetching content from any host—including internal services and cloud metadata endpoints. This could expose sensitive information or facilitate attacks on internal infrastructure.

Technologies: @astrojs/node (npm). Vendors: npm.

Quick answers

Is CVE-2026-27829 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-27829 being exploited in the wild.
How severe is CVE-2026-27829?: Low severity, with a CVSS score of 3.1, published 25 February 2026.
Which products and versions are affected?: @astrojs/node (npm) SEMVER:introduced=9.0.0,fixed=9.5.4.
Is there a fix for CVE-2026-27829?: Yes. @astrojs/node (npm): upgrade to 9.5.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-27829 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-27829?: Check whether you run @astrojs/node (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@astrojs/node (npm): upgrade to 9.5.4 or later
```
npm install @astrojs/node@9.5.4
```

Technical details

The vulnerability is a Server-Side Request Forgery (CWE-918) in Astro's image pipeline. The inferSize option, which fetches remote images at render time to infer their dimensions, fails to enforce the image.domains and image.remotePatterns allowlist restrictions that should control which hosts can be accessed. An attacker who can influence the image URL parameter (via CMS content, user input, or other untrusted sources) can cause the server to make HTTP requests to arbitrary hosts. The vulnerability affects @astrojs/node versions 9.0.0 through 9.5.3 and is fixed in 9.5.4 and later.

Affected products

Astro @astrojs/node 9.0.0 to 9.5.3

Identifiers

CVE-2026-27829
GHSA-cj9f-h6r6-4cx2

Timeline

2026-02-25: disclosed
2026-02-25: patched: Fixed in @astrojs/node 9.5.4

References

https://github.com/withastro/astro/security/advisories/GHSA-cj9f-h6r6-4cx2

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.