Executive brief
The @astrojs/netlify adapter converts Astro's image allowlist rules into Netlify Image CDN configuration, but applies broader matching patterns than intended. This allows public image requests to bypass hostname and path restrictions that developers configured, potentially exposing images from unintended hosts or deeper directory paths. An attacker can request images through the Netlify CDN endpoint that would normally be rejected by Astro's validation.
Technical details
The @astrojs/netlify adapter converts Astro's image.remotePatterns into JavaScript regular expressions for Netlify Image CDN's images.remote_images configuration. However, the generated regexes have broader semantics than Astro's canonical matchers: wildcard hostnames like *.example.com are converted to optional subdomain patterns ([a-z0-9-]+\.)?example\.com, which matches the apex host (example.com) that Astro rejects; wildcard paths like /ok/* are generated without end-of-URL anchoring, allowing deeper paths like /ok/a/b to match when only /ok/a should match. An unauthenticated attacker can exploit this by making requests to the /.netlify/images endpoint with crafted URL parameters to fetch images that bypass the intended allowlist. The vulnerability affects @astrojs/netlify versions through 7.0.10; version 7.0.13 and later contain a fix that generates regexes matching Astro's exact hostname and pathname semantics with proper anchoring.
Affected products
- Astro @astrojs/netlify <=7.0.10
Timeline
- 2026-06-16: disclosed
- 2026-06-16: patched: version 7.0.13