https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 23:37:14 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-329225 EUVD-2026-329225 https://cve.radiocsirt.org/vuln/euvd-2026-329225 https://cve.radiocsirt.org/vuln/fkie_cve-2026-54300 <p>@astrojs/netlify is an adapter that allows Astro to deploy your hybrid or server rendered site to Netlify. Prior to 7.0.13, @astrojs/netlify converts Astro image.remotePatterns into Netlify Image CDN images.remote_images regular expressions with broader semantics than Astro&#39;s canonical matcher. A single wildcard hostname such as *.example.com is converted to an optional subdomain regex, so the apex host matches. A single wildcard pathname such as /ok/* is converted without end anchoring, so deeper paths match by prefix. This vulnerability is fixed in 7.0.13.</p> <p>@astrojs/netlify is an adapter that allows Astro to deploy your hybrid or server rendered site to Netlify. Prior to 7.0.13, @astrojs/netlify converts Astro image.remotePatterns into Netlify Image CDN images.remote_images regular expressions with broader semantics than Astro&#39;s canonical matcher. A single wildcard hostname such as *.example.com is converted to an optional subdomain regex, so the apex host matches. A single wildcard pathname such as /ok/* is converted without end anchoring, so deeper paths match by prefix. This vulnerability is fixed in 7.0.13.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-54300 https://cve.radiocsirt.org/vuln/ghsa-529g-xq4f-cw38 <p><strong>Affected:</strong> npm: @astrojs/netlify</p> <p>## Summary</p> <p>`@astrojs/netlify` converts Astro `image.remotePatterns` into Netlify Image CDN `images.remote_images` regular expressions with broader semantics than Astro&#39;s canonical matcher. A single wildcard hostname such as `*.example.com` is converted to an optional subdomain regex, so the apex host matches. A single wildcard pathname such as `/ok/*` is converted without end anchoring, so deeper paths match by prefix.</p> <p>## Technical details</p> <p>The Netlify adapter generates regex strings for Netlify Image CDN from `image.remotePatterns`. For `*.example.com`, it emits `([a-z0-9-]+\\.)?example\\.com`, which makes the subdomain optional. Astro&#39;s canonical helper requires exactly one subdomain and rejects the apex host.</p> <p>For `/ok/*`, the adapter emits a segment regex but does not anchor the end of the URL. Netlify&#39;s Image CDN implementation treats `images.remote_images` entries as JavaScript regular expressions and calls `.test(sourceImageUrl.href)`, so a URL such as `/ok/a/b.svg` matches the `/ok/a` prefix even though Astro&#39;s helper rejects it.</p> <p>The latest npm package `@astrojs/netlify@7.0.10` contains this conversion logic, and a minimal Astro build writes the broadened patterns into `.netlify/v1/config.json`.</p> <p>## Reproduction</p> <p>1. Create an Astro app using `astro@6.3.8` and `@astrojs/netlify@7.0.10`. 2. Configure Netlify output and a restrictive image pattern, for example `remotePatterns: [{ protocol: &#39;http&#39;, hostname: &#39;*.localhost&#39;, pathname: &#39;/ok/*&#39; }]`. 3. Build the app and o…</p> <p><strong>Affected:</strong> npm: @astrojs/netlify</p> <p>## Summary</p> <p>`@astrojs/netlify` converts Astro `image.remotePatterns` into Netlify Image CDN `images.remote_images` regular expressions with broader semantics than Astro&#39;s canonical matcher. A single wildcard hostname such as `*.example.com` is converted to an optional subdomain regex, so the apex host matches. A single wildcard pathname such as `/ok/*` is converted without end anchoring, so deeper paths match by prefix.</p> <p>## Technical details</p> <p>The Netlify adapter generates regex strings for Netlify Image CDN from `image.remotePatterns`. For `*.example.com`, it emits `([a-z0-9-]+\\.)?example\\.com`, which makes the subdomain optional. Astro&#39;s canonical helper requires exactly one subdomain and rejects the apex host.</p> <p>For `/ok/*`, the adapter emits a segment regex but does not anchor the end of the URL. Netlify&#39;s Image CDN implementation treats `images.remote_images` entries as JavaScript regular expressions and calls `.test(sourceImageUrl.href)`, so a URL such as `/ok/a/b.svg` matches the `/ok/a` prefix even though Astro&#39;s helper rejects it.</p> <p>The latest npm package `@astrojs/netlify@7.0.10` contains this conversion logic, and a minimal Astro build writes the broadened patterns into `.netlify/v1/config.json`.</p> <p>## Reproduction</p> <p>1. Create an Astro app using `astro@6.3.8` and `@astrojs/netlify@7.0.10`. 2. Configure Netlify output and a restrictive image pattern, for example `remotePatterns: [{ protocol: &#39;http&#39;, hostname: &#39;*.localhost&#39;, pathname: &#39;/ok/*&#39; }]`. 3. Build the app and o…</p> https://cve.radiocsirt.org/vuln/ghsa-529g-xq4f-cw38