CVE-2026-102983: Astro: Netlify Image CDN allowlist bypass enables SSRF
The @astrojs/netlify adapter generated regular expressions for Netlify Image CDN remote-image allowlists without anchoring them to the beginning of the URL. Netlify evaluates these expressions with RegExp.test(), so an allowed image origin appearing anywhere in a URL, including its path or query string, could satisfy the allowlist.
For example, an application allowing images.example.com could accept a source URL such as:
http://127.0.0.1:6379/?url=https://images.example.com/image.png
The allowlist matched the approved origin in the query string, but Netlify parsed and fetched the URL whose actual host was 127.0.0.1.
References
- github.com/advisories/GHSA-4233-jc72-56c5
- github.com/withastro/astro/commit/e362d4cf540b27730482455c8fc02efe57d16702
- github.com/withastro/astro/pull/17752
- github.com/withastro/astro/releases/tag/@astrojs/netlify@8.2.4
- github.com/withastro/astro/security/advisories/GHSA-4233-jc72-56c5
- nvd.nist.gov/vuln/detail/CVE-2026-102983
Code Behaviors & Features
Detect and mitigate CVE-2026-102983 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →