CVE-2026-73425

Name of the Vulnerable Software and Affected Versions Astro versions prior to 8.1.2

Description The Astro Netlify adapter improperly handles the conversion of image.remotePatterns entries into regular expressions for the Netlify Image CDN allowlist. In the remotePatternToRegex() function, while dots in hostname values are escaped, literal pathname values are interpolated without escaping regular expression metacharacters such as ., +, ?, (, and [. This allows a restrictive pathname to match unintended paths, including those crossing segments. Because Netlify enforces these regular expressions directly and the matchPattern() helper does not revalidate requests, it is possible to optimize images on an allowed host that the declared pathname was intended to exclude.

Recommendations Update to version 8.1.2.