{"id":"CVE-2026-73425","sourceIdentifier":"security-advisories@github.com","published":"2026-08-12T21:17:41.473","lastModified":"2026-10-24T15:10:00.190","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Astro is a web framework for content-driven websites. Prior to 8.1.2, the Astro Netlify adapter converts each image.remotePatterns entry into a regular expression written to .netlify/v1/config.json under images.remote_images for Netlify's Image CDN allowlist. In packages/integrations/netlify/src/index.ts, remotePatternToRegex() escapes dots in hostname values but interpolates literal pathname values without escaping regular expression metacharacters such as ., +, ?, (, and [, so a restrictive pathname such as /img/v1.0/file also matches metacharacter-adjacent paths, including paths that cross a segment. Netlify enforces the generated regular expression directly and Astro's matchPattern() helper does not revalidate the request, allowing optimization of images on an already-allowed host that the declared pathname was intended to exclude. This issue is fixed in version 8.1.2."},{"lang":"es","value":"Astro es un web framework para sitios web basados en contenido. Antes de la versión 8.1.2, el adaptador de Astro para Netlify convierte cada entrada de image.remotePatterns en una expresión regular escrita en .netlify/v1/config.json bajo images.remote_images para la lista de permitidos (allowlist) del CDN de imágenes de Netlify. En packages/integrations/netlify/src/index.ts, remotePatternToRegex() escapa los puntos en los valores de hostname pero interpola valores literales de pathname sin escapar metacaracteres de expresiones regulares como ., +, ?, (, y [, por lo que un pathname restrictivo como /img/v1.0/file también coincide con rutas adyacentes a metacaracteres, incluyendo rutas que cruzan un segmento. Netlify aplica directamente la expresión regular generada y la función auxiliar matchPattern() de Astro no revalida la solicitud, permitiendo la optimización de imágenes en un host ya permitido que el pathname declarado pretendía excluir. Este problema se ha solucionado en la versión 8.1.2."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"withastro","product":"astro","versions":[{"version":"< 8.1.2","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":3.7,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-13T12:55:52.891809Z","id":"CVE-2026-73425","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-185"}]}],"references":[{"url":"https://github.com/withastro/astro/security/advisories/GHSA-hp3v-mfqw-h74c","source":"security-advisories@github.com"}]}