CVE-2026-126364: Astro: Image endpoint in @astrojs/node can read files from a case-variant sibling of the output directory on case-sensitive filesystems

The /_image endpoint used by the @astrojs/node adapter checks that a requested local image is inside the build output directory before reading it from disk. That check compared paths case-insensitively. On case-sensitive filesystems (such as Linux), a directory whose path differs from the output directory only by letter case is a different directory, but it passed the check.

For example, with the client output directory at /srv/app/dist/client/, a request such as:

/_image?href=/../../DIST/client/secret.png&w=32&f=png

resolved to /srv/app/DIST/client/secret.png and was served, even though that file is outside the output directory.