# CVE-2026-33769: Astro remotePatterns allowlist bypass via unanchored wildcard

Source: https://junglewise.ai/threats/cve-2026-33769-astro-remotepatterns-allowlist-bypass-via-unanchored-wildcard  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-26. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-33769 · Severity: low · CVSS 3.1 · Published 2026-03-26

Astro is a web framework that enforces path allowlists on remote image resources through the image optimization endpoint. A flaw in the path matching logic allows attackers to bypass these restrictions and fetch unintended resources from allowlisted hosts, potentially exposing sensitive data or enabling server-side request forgery (SSRF) attacks beyond the configured path restrictions.

Technologies: [astro (npm)](https://junglewise.ai/threats/technologies/astro). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-33769 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-33769 being exploited in the wild.

**How severe is CVE-2026-33769?** Low severity, with a CVSS score of 3.1, published 26 March 2026.

**Which products and versions are affected?** astro (npm) SEMVER:introduced=2.10.10,fixed=5.18.1.

**Is there a fix for CVE-2026-33769?** Yes. astro (npm): upgrade to 5.18.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-33769 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-33769?** Check whether you run astro (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- astro (npm): upgrade to 5.18.1 or later

  ```sh
  npm install astro@5.18.1
  ```


## Technical details

The vulnerability exists in Astro's matchPathname() function within the remote pattern validation logic. When handling wildcard patterns ending in "/*", the code uses String.replace() without anchoring the pattern, allowing any pathname containing the allowed prefix anywhere in the path (not just at the start) to match. For example, a pattern configured to allow "/img/*" incorrectly matches requests to "/evil/img/secret" because the replace() call removes the "/img/" substring regardless of position. This unanchored matching affects the image optimization endpoint's server-side URL validation. The vulnerable code was introduced in versions after 2.10.10 through 5.18.0 and has been patched in version 5.18.1.

## Affected products

- Astro Astro >2.10.10, <=5.18.0

## Identifiers

- CVE-2026-33769
- GHSA-g735-7g2w-hh3f

## Timeline

- 2026-03-26: disclosed
- 2026-03-26: patched: Patch released as version 5.18.1

## References

- [https://github.com/withastro/astro/security/advisories/GHSA-g735-7g2w-hh3f](https://github.com/withastro/astro/security/advisories/GHSA-g735-7g2w-hh3f)

## Related threats

- [Astro HTML injection in script and style element rendering](https://junglewise.ai/threats/cve-2026-114128-astro-is-a-web-framework-for-content-driven-websites-prior-to-7)
- [Astro CSS injection in View Transition animation values](https://junglewise.ai/threats/cve-2026-114127-astro-is-a-web-framework-for-content-driven-websites-from-7-1-0)
- [Astro remote code execution via AVIF image processing](https://junglewise.ai/threats/astro-remote-code-execution-via-avif-image-processing-6b99ffe8)
- [Astro authorization bypass in base path stripping](https://junglewise.ai/threats/cve-2026-84376-astro-authorization-bypass-in-base-path-stripping)
- [Astro composable astro/hono pipeline CSRF via origin check bypass](https://junglewise.ai/threats/cve-2026-73423-astro-composable-astro-hono-pipeline-csrf-via-origin-check-bypass)