Astro Netlify Adapter EUVD-2026-57610

Three conditions must all be present: (1) the site uses @astrojs/netlify adapter at a version prior to 8.1.2, (2) at least one image.remotePatterns entry is configured with a literal pathname value containing a regex metacharacter - the most common real-world case is a dot in a version string (e.g., /img/v1.0/) or a file extension - and (3) the built site is deployed to Netlify with Netlify Image CDN active. Exploitation is bounded to hostnames already present in the allowlist; the attacker cannot introduce new hosts. There is no authentication requirement to call Netlify's image optimization endpoint. Sites that use only wildcard pathnames (/**) or pathnames free of metacharacters are not affected even if running a vulnerable version, because the regex generated for those patterns already matches the broader set the developer intended.

The provided CVSS 3.7 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) is consistent with independent analysis. AC:H correctly reflects that exploitation requires the target deployment to have configured a pathname containing at least one regex metacharacter (most commonly a literal dot in a version string or filename extension), which is a non-universal but realistic configuration. The confidentiality impact is limited to C:L: an attacker can cause Netlify's CDN to optimize and serve images from path variations that should be excluded, but only on hostnames already present in the allowlist - no new hosts can be added and there is no integrity or availability impact. EPSS data was not provided in the input; given the narrow exploitation prerequisites and absence from CISA KEV, real-world exploitation probability is assessed as low. A proof-of-concept is publicly available in the GHSA advisory, which modestly elevates urgency, but the low severity and specific prerequisites mean this is not a broad-blast-radius priority. The discrepancy between PR:N in the CVSS vector and the fact that only developer-controlled configurations trigger the flaw is worth noting: the vulnerability is introduced at build time by the developer's own config, but the exploitation window is Netlify's CDN endpoint which is unauthenticated.

An attacker inspecting a Netlify-hosted Astro site's public CDN behavior identifies that the site allows image optimization for cdn.example.com. They request Netlify's image optimization endpoint with a URL pointing to https://cdn.example.com/img/v1X0/secret-file - where X replaces the dot in a version path segment - and Netlify's CDN processes the request because the unescaped dot in the generated allowlist regex matches any character, including the substituted character. A proof-of-concept demonstrating this exact bypass (including path-segment crossing via /) is included in GHSA-hp3v-mfqw-h74c.