# CVE-2026-73425: Astro @astrojs/netlify unescaped regex metacharacters in image CDN allowlist

Source: https://junglewise.ai/threats/cve-2026-73425-astro-astrojs-netlify-unescaped-regex-metacharacters-in-image-cdn  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-12. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-73425 · Severity: low · CVSS 3.7 · Published 2026-08-12

The @astrojs/netlify integration generates an image content allowlist for Netlify's Image CDN based on security patterns defined by developers. Due to improper escaping of special characters in URL paths, the allowlist becomes overly permissive and accepts image URLs that should have been blocked. An attacker with access to alternative image paths on the same host (using characters like dots or other regex metacharacters) could potentially optimize images through the CDN that the developer intended to exclude.

Technologies: [@astrojs/netlify (npm)](https://junglewise.ai/threats/technologies/astrojs-netlify). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-73425 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-73425 being exploited in the wild.

**How severe is CVE-2026-73425?** Low severity, with a CVSS score of 3.7, published 12 August 2026.

**Which products and versions are affected?** @astrojs/netlify (npm) SEMVER:introduced=0,fixed=8.1.2.

**Is there a fix for CVE-2026-73425?** Yes. @astrojs/netlify (npm): upgrade to 8.1.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-73425 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-73425?** Check whether you run @astrojs/netlify (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @astrojs/netlify (npm): upgrade to 8.1.2 or later

  ```sh
  npm install @astrojs/netlify@8.1.2
  ```


## Technical details

The vulnerability is an improper regex escape issue in the remotePatternToRegex() function in packages/integrations/netlify/src/index.ts. The function correctly escapes dots in the hostname component but fails to escape regex metacharacters (such as . + ? [ ( etc.) in the literal pathname component before interpolating it into a regular expression. This causes unintended pathname broadening: for example, a pathname pattern /img/v1.0/file will incorrectly match /img/v1X0/file because the unescaped dot matches any character, and can even match forward slashes crossing path segments. The security boundary is the generated regex itself, enforced directly by Netlify's Image CDN with no compensating validation layer. The fix escapes all metacharacters in literal path portions before regex interpolation and has been shipped in version 8.1.2.

## Affected products

- Astro @astrojs/netlify <=8.1.1

## Identifiers

- CVE-2026-73425
- GHSA-hp3v-mfqw-h74c

## Timeline

- 2026-07-20: disclosed
- 2026-07-15: patched: fix available in version 8.1.2

## References

- [https://github.com/withastro/astro/security/advisories/GHSA-hp3v-mfqw-h74c](https://github.com/withastro/astro/security/advisories/GHSA-hp3v-mfqw-h74c)

## Related threats

- [Astro @astrojs/netlify adapter unanchored regex bypass in image allowlist](https://junglewise.ai/threats/cve-2026-102983-astro-is-a-web-framework-for-content-driven-websites-from-5-2-0)
- [Astro @astrojs/netlify SSRF via improper image pattern conversion](https://junglewise.ai/threats/cve-2026-54300-astro-astrojs-netlify-ssrf-via-improper-image-pattern-conversion)