CVE-2026-102983: Astro: Netlify Image CDN allowlist bypass enables SSRF
The @astrojs/netlify adapter generated regular expressions for Netlify Image CDN remote-image allowlists without anchoring them to the beginning of the URL. Netlify evaluates these expressions with RegExp.test(), so an allowed image origin appearing anywhere in a URL, including its path or query string, could satisfy the allowlist.
For example, an application allowing images.example.com could accept a source URL such as:
http://127.0.0.1:6379/?url=https://images.example.com/image.png
The allowlist matched the approved origin in the query string, but Netlify parsed and fetched the URL whose actual host was 127.0.0.1.
References
- github.com/advisories/GHSA-4233-jc72-56c5
- github.com/withastro/astro/commit/e362d4cf540b27730482455c8fc02efe57d16702
- github.com/withastro/astro/pull/17752
- github.com/withastro/astro/releases/tag/@astrojs/netlify@8.2.4
- github.com/withastro/astro/security/advisories/GHSA-4233-jc72-56c5
- nvd.nist.gov/vuln/detail/CVE-2026-102983
Code Behaviors & Features
Detect and mitigate CVE-2026-102983 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →