Advisories for Npm/@Astrojs/Netlify package

The @astrojs/netlify adapter generated regular expressions for Netlify Image CDN remote-image allowlists without anchoring them to the beginning of the URL. Netlify evaluates these expressions with RegExp.test(), so an allowed image origin appearing anywhere in a URL, including its path or query string, could satisfy the allowlist. For example, an application allowing images.example.com could accept a source URL such as: http://127.0.0.1:6379/?url=https://images.example.com/image.png The allowlist matched the approved origin in the query …

The @astrojs/netlify adapter converts each image.remotePatterns entry into a regular expression that is written to .netlify/v1/config.json under images.remote_images. Netlify's Image CDN uses these regexes as the allowlist that decides which remote image URLs it will optimize. remotePatternToRegex() escapes . in the hostname but interpolates the literal pathname into the regex without escaping regex metacharacters. As a result, the generated allowlist is broader than the pattern the developer declared, and broader …

@astrojs/netlify converts Astro image.remotePatterns into Netlify Image CDN images.remote_images regular expressions with broader semantics than Astro's canonical matcher. A single wildcard hostname such as .example.com is converted to an optional subdomain regex, so the apex host matches. A single wildcard pathname such as /ok/ is converted without end anchoring, so deeper paths match by prefix.