p PatchFirst

CVE-2026-33769

CVE-2026-33769 · Astro: Remote allowlist bypass via unanchored matchPathname wildcard

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Astro is a web framework. From version 2.10.10 to before version 5.18.1, this issue concerns Astro's remotePatterns path enforcement for remote URLs used by server-side fetchers such as the image optimization endpoint. The path matching logic for /* wildcards is unanchored, so a pathname that contains the allowed prefix later in the path can still match. As a result, an attacker can fetch paths outside the intended allowlisted prefix on an otherwise allowed host. This issue has been patched in version 5.18.1.

CVSS 2.9 · Low · EPSS 0.4% · Fix available

Published
Updated

Stack: node

Affected products and versions

  • astro

    Versions
    • >= 2.10.10, < 5.18.1: Affected

    No fix published

  • astro npm

    Affected ranges
    • SEMVER: ≥ 2.10.10, < 5.18.1

    Update to 5.18.1

Original sources

Check your server →