CVE-2026-54300

Name of the Vulnerable Software and Affected Versions @astrojs/netlify versions prior to 7.0.13

Description The adapter converts image.remotePatterns into Netlify Image CDN images.remote images regular expressions using semantics broader than the canonical matcher. This occurs because a single wildcard hostname, such as *.example.com, is converted to an optional subdomain regex, allowing the apex host to match. Additionally, a single wildcard pathname, such as /ok/*, is converted without end anchoring, allowing deeper paths to match by prefix. This can expose a wider image-fetch boundary than intended, potentially disclosing image-like resources from unintended hosts or paths that the application intended to isolate.

Recommendations Update to version 7.0.13.