CVE-2026-54300 @astrojs/netlify broadens Astro image.remotePatterns in Netlify Image CDN config
The Astro Netlify adapter incorrectly converts image remote patterns, allowing Server-Side Request Forgery by matching unintended hosts and paths.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-54300?
CVE-2026-54300 is a medium-severity server-side request forgery vulnerability in withastro astro, published on 22 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
@astrojs/netlify is an adapter that allows Astro to deploy your hybrid or server rendered site to Netlify. Prior to 7.0.13, @astrojs/netlify converts Astro image.remotePatterns into Netlify Image CDN images.remote_images regular expressions with broader semantics than Astro's canonical matcher. A single wildcard hostname such as *.example.com is converted to an optional subdomain regex, so the apex host matches. A single wildcard pathname such as /ok/* is converted without end anchoring, so deeper paths match by prefix. This vulnerability is fixed in 7.0.13.
Weakness: CWE-918
Which versions are affected by CVE-2026-54300?
2 open source packages ship an affected version, including @astrojs/netlify.
| Package | Affected | Fixed in |
|---|---|---|
@astrojs/netlify npm | All versions | 7.0.13 |
@astrojs/netlify npm | All versions | 7.0.13 |
How do I fix CVE-2026-54300?
Upgrade @astrojs/netlify to 7.0.13 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-54300 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-54300 exists.
Sources
Also known as GHSA-529g-xq4f-cw38.