CVE-2026-27829
Astro is a web framework.
Published Feb 26, 2026 · updated Jun 17, 2026 · astro @astrojs/node
Astro is a web framework. In versions 9.0.0 through 9.5.3, a bug in Astro's image pipeline allows bypassing / restrictions, enabling the server to fetch content from unauthorized remote hosts. Astro provides an option that fetches remote images at render time to determine their dimensions. Remote image fetches are intended to be restricted to domains the site developer has manually authorized (using the or options). However, when is used, no domain validation is performed — the image is fetched from any host regardless of the configured restrictions. An attacker who can influence the image URL (e.g., via CMS content or user-supplied data) can cause the server to fetch from arbitrary hosts. This allows bypassing / restrictions to make server-side requests to unauthorized hosts. This includes the risk of server-side request forgery (SSRF) against internal network services and cloud metadata endpoints. Version 9.5.4 fixes the issue.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Feb 26, 2026 · NIST NVD
Detected
Astro is a web framework. In versions 9.0.0 through 9.5.3, a bug in Astro's image pipeline allows bypassing / restrictions, enabling the server to fetch content from unauthorized remote hosts. Astro provides an option that fetches remote images at render time to determine their dimensions. Remote image fetches are intended to be restricted to domains the site developer has manually authorized (usi
Jun 17, 2026 · NIST NVD
Updated
Astro is a web framework. In versions 9.0.0 through 9.5.3, a bug in Astro's image pipeline allows bypassing / restrictions, enabling the server to fetch content from unauthorized remote hosts. Astro provides an option that fetches remote images at render time to determine their dimensions. Remote image fetches are intended to be restricted to domains the site developer has manually authorized (usi
Affected
- cpe astro/@astrojs/nodeversion unspecified
Sources
- NIST NVDVulnerability recordCVE-2026-27829
Astro is a web framework. In versions 9.0.0 through 9.5.3, a bug in Astro's image pipeline allows bypassing / restrictions, enabling the server to fetch content from unauthorized remote hosts. Astro provides an option that fetche
nvd.nist.gov