@astrojs/netlify Adapter CVE-2026-102983

Exploitable only when the site is built with the @astrojs/netlify adapter (versions 5.2.0 up to 8.2.4) AND configured to use Netlify Image CDN with a remote-image allowlist via image.domains or image.remotePatterns; the vulnerable regexes are generated from those settings. The /.netlify/images endpoint must be publicly reachable (its default state). No authentication or user interaction is required (PR:N/UI:N). Exploitation is LIMITED by Netlify egress protections, which constrain which internal/external targets are actually reachable, and by image-transformation limits, which prevent exfiltrating fetched response bodies - hence AT:P and availability-only impact.

This is a genuine but low-severity SSRF-class flaw (CWE-625, permissive regex). The vendor CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L) scores 6.3 and correctly reflects an unauthenticated network-reachable issue with only limited availability impact (VA:L) and NO confidentiality or integrity impact - the description explicitly states 'no confidentiality or integrity impact has been demonstrated.' The AT:P (attack requirements present) captures that Netlify egress protections constrain reachable targets and image-transformation limits prevent direct response exfiltration, so the practical impact is server-side request forgery for internal probing/reachability rather than data theft. No EPSS score, no CISA KEV listing, and no public exploit code are provided in the input, so there is no signal of active or automatable exploitation. The 6.3 'medium' rating is somewhat generous relative to real-world risk: the actual demonstrated impact is limited to causing the Image CDN to fetch attacker-selected URLs, with egress filtering and transformation limits blunting most useful outcomes. Note the 'Information Disclosure' tag overstates impact - the CVE explicitly disclaims confidentiality/integrity impact; the true nature is SSRF/internal-service probing. Priority is low-to-medium: patch as routine hygiene, prioritized only for sites relying on image.domains/image.remotePatterns allowlists as a security boundary.

An attacker sends an unauthenticated request to the public /.netlify/images endpoint on an Astro site deployed via @astrojs/netlify, supplying a source URL like 'http://169.254.169.254/latest/meta-data/?url=https://allowed-origin.example/image.jpg'. Because the generated allowlist regex is not anchored to the start of the URL, the allowed origin appearing only in the query string satisfies RegExp.test(), so the Image CDN fetches the attacker-controlled host and can probe internal services (e.g., cloud metadata endpoints, 127.0.0.1:6379). No public exploit code is identified at time of analysis, though the fixing PR includes explicit regression tests demonstrating the bypass payloads.