CVE-2026-27829: Astro is vulnerable to SSRF due to missing allowlist enforcement in remote image inferSize

February 25, 2026 (updated February 27, 2026)

A bug in Astro’s image pipeline allows bypassing image.domains / image.remotePatterns restrictions, enabling the server to fetch content from unauthorized remote hosts.

References

github.com/advisories/GHSA-cj9f-h6r6-4cx2
github.com/withastro/astro
github.com/withastro/astro/commit/e01e98b063e90d274c42130ec2a60cc0966622c9
github.com/withastro/astro/security/advisories/GHSA-cj9f-h6r6-4cx2
nvd.nist.gov/vuln/detail/CVE-2026-27829

Code Behaviors & Features

Detect and mitigate CVE-2026-27829 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →