CVE-2026-73425 - @astrojs/netlify generates an overly-broad Netlify Image CDN allowlist because remotePatterns.pathname metacharacters are not escaped
Brief
CVE ID : CVE-2026-73425
Published : Aug. 12, 2026, 8:41 p. m.
- 23 minutes ago
Description : Astro is a web framework for content-driven websites. Prior to 8.
- 2, the Astro Netlify adapter converts each image. remotePatterns entry into a regular expression written to . netlify/v1/config. json under images. remote_images for Netlify's Image CDN allowlist. In packages/integrations/netlify/src/index.
ts, remotePatternToRegex() escapes dots in hostname values but interpolates literal pathname values without escaping regular expression metacharacters such as . , +, ? , (, and [, so a restrictive pathname such as /img/v1. 0/file also matches metacharacter-adjacent paths, including paths that cross a segment.