CVE-2026-73425Low· 3.7▾ SunlitAstro is a web framework for content-driven websites. Prior to 8.1.2, the Astro Netlify adapter converts each image.remotePatterns entry into a regular expression written to .netlify/v1/config.json under images.remote_images for Netlify'…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 20.4 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 9.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.2%
0.2% → 0.3%
Astro is a web framework for content-driven websites. Prior to 8.1.2, the Astro Netlify adapter converts each image.remotePatterns entry into a regular expression written to .netlify/v1/config.json under images.remote_images for Netlify's Image CDN allowlist. In packages/integrations/netlify/src/index.ts, remotePatternToRegex() escapes dots in hostname values but interpolates literal pathname values without escaping regular expression metacharacters such as ., +, ?, (, and [, so a restrictive pathname such as /img/v1.0/file also matches metacharacter-adjacent paths, including paths that cross a segment. Netlify enforces the generated regular expression directly and Astro's matchPattern() helper does not revalidate the request, allowing optimization of images on an already-allowed host that the declared pathname was intended to exclude. This issue is fixed in version 8.1.2.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
GHSA-hp3v-mfqw-h74cLow· 3.7@astrojs/netlify generates an overly-broad Netlify Image CDN allowlist because remotePatterns.pathname metacharacters are not escaped
CVE-2026-114653Medium· 6.5Silent client-side encryption bypass via unescaped field-name regex in CSFLE schema builder
CVE-2026-111755Medium· 5.9follow-redirects: follow-redirects: Information disclosure via improper regular expression escaping in sensitive header filtering (CVE-2026…
CVE-2026-111057Critical· 10.0Mercury: Unauthenticated Remote Code Execution in /api/terminals - access control bypass
CVE-2026-47674Medium· 5.3Hono is a Web application framework that provides support for any JavaScript runtime
CVE-2018-7158High· 7.5The `'path'` module in the Node.js 4.x release line contains a potential regular expression denial of service (ReDoS) vector