CVE-2026-54300: @astrojs/netlify Broadens Image Fetching Patterns, Exposing Potential Security Risks
Summary
CVE-2026-54300: @astrojs/netlify broadens Astro image.remotePatterns in Netlify Image CDN config. Affects @astrojs/netlify versions < 7.0.13. Fixed in 7.0.13. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @astrojs/netlify package is an adapter for integrating Astro applications with Netlify's hosting and image processing services. It allows developers to configure image fetching patterns for remote images, enabling efficient image handling in web applications. However, a recent vulnerability has been identified that broadens the scope of these fetching patterns, potentially leading to unintended exposure of resources.
Vulnerability Detail
The vulnerability arises from the way @astrojs/netlify converts Astro's image.remotePatterns into regex for Netlify's Image CDN. Specifically, it allows broader matching than intended, such as accepting apex hosts for wildcard patterns and deeper paths for specified patterns. This discrepancy can lead to unauthorized access to images or resources that should be restricted, as the Netlify Image CDN may fetch images from unintended sources. The technical details reveal that the regex generation does not enforce strict matching rules, which can compromise the security of applications relying on these configurations.
How To Fix
Latest published version: 8.2.10 as of 23 Oct 2026
npm install @astrojs/netlify@8.2.10Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
7.0.13
This is the first release that contains the fix.
npm install @astrojs/netlify@7.0.13Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can manually adjust your image.remotePatterns to be more restrictive, ensuring that they do not include wildcard patterns that could lead to broader matches. For example, instead of using '*.example.com', specify exact subdomains.
Conclusion
The CVE-2026-54300 vulnerability in the @astrojs/netlify package poses a risk by broadening image fetching patterns, potentially exposing sensitive resources. It is crucial to update to the patched version 7.0.13 to mitigate this risk and ensure that your application remains secure.
See every vulnerability recorded for @astrojs/netlify →
FAQ
CVE-2026-54300 is a vulnerability in the @astrojs/netlify package that broadens image fetching patterns, potentially exposing resources that should be restricted.
If your application uses @astrojs/netlify with broad image fetching patterns, it may inadvertently expose images from unintended sources, leading to security risks.
You can use Vulert, a tool that monitors open-source vulnerabilities in your software. By analyzing your package-lock.json, it can alert you to any vulnerabilities, including CVE-2026-54300.
As a temporary measure, restrict your image.remotePatterns to avoid using wildcard patterns that could lead to broader matches.
The CVSS score of this vulnerability is 5.3, indicating a moderate level of risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for @astrojs/netlify.
