https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T18:08:20.153473+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-329225 EUVD-2026-329225 2026-10-06T18:08:20.215930+00:00 EUVD-2026-329225 https://cve.radiocsirt.org/vuln/fkie_cve-2026-54300 fkie_cve-2026-54300 2026-10-06T18:08:20.215986+00:00

@astrojs/netlify is an adapter that allows Astro to deploy your hybrid or server rendered site to Netlify. Prior to 7.0.13, @astrojs/netlify converts Astro image.remotePatterns into Netlify Image CDN images.remote_images regular expressions with broader semantics than Astro's canonical matcher. A single wildcard hostname such as *.example.com is converted to an optional subdomain regex, so the apex host matches. A single wildcard pathname such as /ok/* is converted without end anchoring, so deeper paths match by prefix. This vulnerability is fixed in 7.0.13.

 https://cve.radiocsirt.org/vuln/ghsa-529g-xq4f-cw38 GHSA-529g-xq4f-cw38 — @astrojs/netlify broadens Astro image.remotePatterns in Netlify Image CDN config 2026-10-06T18:08:20.216038+00:00

Affected: npm: @astrojs/netlify

## Summary

`@astrojs/netlify` converts Astro `image.remotePatterns` into Netlify Image CDN `images.remote_images` regular expressions with broader semantics than Astro's canonical matcher. A single wildcard hostname such as `*.example.com` is converted to an optional subdomain regex, so the apex host matches. A single wildcard pathname such as `/ok/*` is converted without end anchoring, so deeper paths match by prefix.

## Technical details

The Netlify adapter generates regex strings for Netlify Image CDN from `image.remotePatterns`. For `*.example.com`, it emits `([a-z0-9-]+\\.)?example\\.com`, which makes the subdomain optional. Astro's canonical helper requires exactly one subdomain and rejects the apex host.

For `/ok/*`, the adapter emits a segment regex but does not anchor the end of the URL. Netlify's Image CDN implementation treats `images.remote_images` entries as JavaScript regular expressions and calls `.test(sourceImageUrl.href)`, so a URL such as `/ok/a/b.svg` matches the `/ok/a` prefix even though Astro's helper rejects it.

The latest npm package `@astrojs/netlify@7.0.10` contains this conversion logic, and a minimal Astro build writes the broadened patterns into `.netlify/v1/config.json`.

## Reproduction

1. Create an Astro app using `astro@6.3.8` and `@astrojs/netlify@7.0.10`. 2. Configure Netlify output and a restrictive image pattern, for example `remotePatterns: [{ protocol: 'http', hostname: '*.localhost', pathname: '/ok/*' }]`. 3. Build the app and o…