Which versions of Astro are affected by EUVD-2026-14984?

CVE-2026-33769 is a low-severity vulnerability in Astro involving input validation (CVSS 2.9).. A patch is available.

How to fix or mitigate EUVD-2026-14984?

During next maintenance window: Apply vendor patches when convenient. Verify input validation controls are in place.

Astro EUVD-2026-14984

Q: What is the CVSS score of EUVD-2026-14984?

EUVD-2026-14984 has a CVSS 4.0 base score of 2.9 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

| CVE-2026-33769 LOW

Improper Input Validation (CWE-20)

2026-03-24 GitHub_M

GHSA-g735-7g2w-hh3f

Information Disclosure Astro

2.9

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

2.9 LOW

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 24, 2026 - 19:00 euvd

EUVD-2026-14984

Analysis Generated

Mar 24, 2026 - 19:00 vuln.today

CVE Published

Mar 24, 2026 - 18:44 nvd

LOW 2.9

DescriptionGitHub Advisory

Astro is a web framework. From version 2.10.10 to before version 5.18.1, this issue concerns Astro's remotePatterns path enforcement for remote URLs used by server-side fetchers such as the image optimization endpoint. The path matching logic for /* wildcards is unanchored, so a pathname that contains the allowed prefix later in the path can still match. As a result, an attacker can fetch paths outside the intended allowlisted prefix on an otherwise allowed host. This issue has been patched in version 5.18.1.

AnalysisAI

Astro's remotePatterns path enforcement contains a logic flaw where wildcard matching for /* is unanchored, allowing attackers to bypass path restrictions and access unintended resources on allowed hosts. Versions 2.10.10 through 5.18.0 are affected, enabling information disclosure through server-side image optimization endpoints and other remote fetchers. The vulnerability has been patched in version 5.18.1, and while no public exploit code or active exploitation has been reported in KEV databases, the straightforward nature of the bypass makes this a moderate to high priority for affected deployments.

Technical ContextAI

Astro is a JavaScript web framework that includes server-side image optimization and remote content fetching capabilities. The remotePatterns configuration is designed to enforce allowlisting of remote URLs to prevent server-side request forgery (SSRF) and unauthorized resource access. The underlying vulnerability stems from improper input validation (CWE-20: Improper Input Validation) in the path-matching logic, where wildcard patterns like /allowed/* are intended to restrict access to paths beginning with /allowed/ but are implemented without proper anchoring to the start of the pathname. This means a malicious URL like https://trusted-host.com/malicious/allowed/sensitive-data could bypass restrictions intended for https://trusted-host.com/allowed/*, since the matching algorithm finds the allowed prefix anywhere in the path rather than enforcing it as the path prefix. The affected product is identified via CPE cpe:2.3:a:withastro:astro:*:*:*:*:*:*:*:* across the vulnerable version range.

RemediationAI

Immediately upgrade Astro to version 5.18.1 or later, which contains the patch correcting the unanchored wildcard matching logic in remotePatterns enforcement. Verify the upgrade by checking the package.json lock file or running npm list astro to confirm the installed version is 5.18.1 or higher. As a temporary workaround prior to patching, review and tighten remotePatterns rules to be as specific as possible, avoiding broad wildcards, and consider implementing an additional reverse proxy or WAF rule to validate outbound requests from the image optimization endpoint. For detailed patch information and confirmation, refer to the official GitHub security advisory at https://github.com/withastro/astro/security/advisories/GHSA-g735-7g2w-hh3f.