{"id":"EUVD-2026-89969","enisaUuid":"e7ff96fd-be7e-3796-bbfe-bb4389d61ea5","description":"Astro is a web framework for content-driven websites. From 5.2.0 until 8.2.4, the @astrojs/netlify adapter generates regular expressions for Netlify Image CDN remote-image allowlists without anchoring them to the beginning of the URL. Because Netlify evaluates these expressions with RegExp.test(), an allowed origin appearing only in a source URL\u0027s path or query can satisfy image.domains or image.remotePatterns while the URL\u0027s actual host remains attacker-controlled. An unauthenticated request to the public /.netlify/images endpoint can therefore cause the Image CDN to request attacker-selected URLs and may probe or reach internal services. Netlify egress protections may constrain reachable targets, and image transformation limits direct response exfiltration; no confidentiality or integrity impact has been demonstrated. This issue is fixed in version 8.2.4.","datePublished":"Sep 30, 2026, 2:32:03 PM","dateUpdated":"Sep 30, 2026, 4:24:47 PM","baseScore":6.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","references":"https://github.com/withastro/astro/security/advisories/GHSA-4233-jc72-56c5\nhttps://github.com/withastro/astro/pull/17752\nhttps://github.com/withastro/astro/commit/e362d4cf540b27730482455c8fc02efe57d16702\nhttps://github.com/withastro/astro/releases/tag/@astrojs/netlify@8.2.4\n","aliases":"CVE-2026-102983\nGHSA-4233-jc72-56c5\n","assigner":"GitHub_M","epss":0.31,"enisaIdProduct":[{"id":"2d336d26-fb64-32ea-aaef-b532ef8a12d0","product":{"name":"astro","vendor":{"name":"withastro"}},"product_version":"5.2.0, \u003c 8.2.4"},{"id":"54d940bb-aaa3-3277-bfcf-2b5356212951","product":{"name":"netlify","vendor":{"name":"@astrojs"}},"product_version":"5.2.0, \u003c 8.2.4"}],"enisaIdVendor":[{"id":"2df8835e-f1a0-326b-8b82-3c091e53119d","vendor":{"name":"withastro"}},{"id":"3abce5f5-5315-3bf8-ae19-56469effffe0","vendor":{"name":"@astrojs"}}],"enisaIdVulnerability":[{"id":"220020c9-cc05-3151-8d8f-853e923f38f3","vulnerability":{"id":"CVE-2026-102983","description":"Astro is a web framework for content-driven websites. From 5.2.0 until 8.2.4, the @astrojs/netlify adapter generates regular expressions for Netlify Image CDN remote-image allowlists without anchoring them to the beginning of the URL. Because Netlify evaluates these expressions with RegExp.test(), an allowed origin appearing only in a source URL\u0027s path or query can satisfy image.domains or image.remotePatterns while the URL\u0027s actual host remains attacker-controlled. An unauthenticated request to the public /.netlify/images endpoint can therefore cause the Image CDN to request attacker-selected URLs and may probe or reach internal services. Netlify egress protections may constrain reachable targets, and image transformation limits direct response exfiltration; no confidentiality or integrity impact has been demonstrated. This issue is fixed in version 8.2.4.","datePublished":"Sep 30, 2026, 2:32:03 PM","dateUpdated":"Sep 30, 2026, 4:24:47 PM","status":"PUBLISHED","baseScore":6.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","references":"https://github.com/withastro/astro/security/advisories/GHSA-4233-jc72-56c5\nhttps://github.com/withastro/astro/pull/17752\nhttps://github.com/withastro/astro/commit/e362d4cf540b27730482455c8fc02efe57d16702\nhttps://github.com/withastro/astro/releases/tag/@astrojs/netlify@8.2.4\n","enisa_id":"EUVD-2026-89969\n","assigner":"GitHub_M","epss":0.31,"dataProcessed":"Nov 6, 2026, 7:16:44 AM","vulnerabilityProduct":[{"id":"00a4ce31-7ba7-340c-9ae6-dc4d03b53da5","product":{"name":"astro","vendor":{"name":"withastro"}},"product_version":"5.2.0, \u003c 8.2.4"},{"id":"a9ef3534-8ecd-3220-acd2-15461ee11dbb","product":{"name":"netlify","vendor":{"name":"@astrojs"}},"product_version":"5.2.0, \u003c 8.2.4"}],"vulnerabilityVendor":[{"id":"83defe96-5c40-3b7b-9edd-81d3e5ae8436","vendor":{"name":"withastro"}},{"id":"d5da3820-7e89-3d74-bb60-76e17d6cdce8","vendor":{"name":"@astrojs"}}]}},{"id":"d7b0c30e-e5ae-310f-a78f-0fe0ed39d611","vulnerability":{"id":"GHSA-4233-jc72-56c5","description":"Astro: Netlify Image CDN allowlist bypass enables SSRF","datePublished":"Sep 30, 2026, 11:40:12 PM","dateUpdated":"Sep 30, 2026, 11:40:12 PM","baseScore":0.0,"references":"https://github.com/withastro/astro/security/advisories/GHSA-4233-jc72-56c5\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-102983\nhttps://github.com/withastro/astro/pull/17752\nhttps://github.com/withastro/astro/commit/e362d4cf540b27730482455c8fc02efe57d16702\nhttps://github.com/withastro/astro\nhttps://github.com/withastro/astro/releases/tag/@astrojs/netlify@8.2.4\n","enisa_id":"EUVD-2026-89969\n","aliases":"GHSA-4233-jc72-56c5\nCVE-2026-102983\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:07:07 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}