CVE-2026-54300
Summary
@astrojs/netlify converts Astro image.remotePatterns into Netlify Image CDN images.remote_images regular expressions with broader semantics than Astro's canonical matcher. A single wildcard hostname such as *.example.com is converted to an optional subdomain regex, so the apex host matches. A single wildcard pathname such as /ok/* is converted without end anchoring, so deeper paths match by prefix.
Technical details
The Netlify adapter generates regex strings for Netlify Image CDN from image.remotePatterns. For *.example.com, it emits ([a-z0-9-]+\\.)?example\\.com, which makes the subdomain optional. Astro's canonical helper requires exactly one subdomain and rejects the apex host.
For /ok/*, the adapter emits a segment regex but does not anchor the end of the URL. Netlify's Image CDN implementation treats images.remote_images entries as JavaScript regular expressions and calls .test(sourceImageUrl.href), so a URL such as /ok/a/b.svg matches the /ok/a prefix even though Astro's helper rejects it.
The latest npm package @astrojs/netlify@7.0.10 contains this conversion logic, and a minimal Astro build writes the broadened patterns into .netlify/v1/config.json.
Reproduction
1. Create an Astro app using astro@6.3.8 and @astrojs/netlify@7.0.10.
2. Configure Netlify output and a restrictive image pattern, for example remotePatterns: [{ protocol: 'http', hostname: '*.localhost', pathname: '/ok/*' }].
3. Build the app and observe that .netlify/v1/config.json contains http://([a-z0-9-]+\\.)?localhost(:[0-9]+)?(\\/ok/[^/?#]+)/?([?][^#]*)?.
4. Serve a canary SVG on 127.0.0.1:9001.
5. Request /.netlify/images?url=http%3A%2F%2Flocalhost%3A9001%2Fok%2Fa.svg&w=100. Astro's helper rejects the apex localhost for *.localhost, but Netlify Image CDN accepts it and fetches the canary.
6. As a negative control, request /.netlify/images?url=http%3A%2F%2Flocalhost%3A9001%2Fnope%2Fa.svg&w=100. This returns 403 Forbidden: Remote image URL not allowed and does not hit the canar
⚡ Watch CVE-2026-54300
Get an email if CVE-2026-54300 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.
Exploitation outlook
- Low exploitation risk0.31% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 24% of all EPSS-scored CVEs.
Advisory coverage (1)
External references
Embed the live status
— this badge updates automatically when the KEV or exploit status changes. How to embed it →
[](https://www.csirts.com/cve/CVE-2026-54300)