CVE-2026-73425: 
JavaScript Analyse et atténuation des vulnérabilités

CVE-2026-73425 is an incorrect regular expression vulnerability in the @astrojs/netlify adapter that causes an overly-broad Netlify Image CDN allowlist due to unescaped remotePatterns.pathname metacharacters. It affects all versions of @astrojs/netlify up to and including 8.1.1 (i.e., Astro versions prior to 8.1.2). The vulnerability was published on July 15, 2026, and fixed in version 8.1.2. It carries a CVSS v3.1 base score of 3.7 (Low) (GitHub Advisory).

The root cause is CWE-185 (Incorrect Regular Expression): in packages/integrations/netlify/src/index.ts, the remotePatternToRegex() function correctly escapes dots in hostname values (e.g., hostname.replace(/\./g, '\\.')) but interpolates the literal pathname value directly into the generated regex without escaping metacharacters such as ., +, ?, (, and [. This means a pathname like /img/v1.0/file produces a regex where the . in v1.0 matches any character — including /, allowing path segment crossing. The generated regex is written to .netlify/v1/config.json under images.remote_images, which Netlify's Image CDN enforces directly; Astro's matchPattern() helper (which uses exact string equality for non-wildcard pathnames) is not invoked in this code path, so there is no compensating validation layer. This is a residual of the same bug class partially addressed in CVE-2026-54300 (GitHub Advisory).

Successful exploitation allows an unauthenticated remote attacker to request Netlify Image CDN optimization for image URLs on an already-allowed host that the developer's remotePatterns configuration was intended to exclude. The hostname anchor remains correctly enforced, so the broadening is confined to the pathname dimension — an attacker cannot reach arbitrary external hosts, only unintended paths on an already-permitted host. The practical impact depends on whether sensitive or unintended images exist at metacharacter-adjacent paths on the allowed host; any pathname containing a . (e.g., file extensions, version strings) is affected. There is no integrity or availability impact (GitHub Advisory).

No public exploit code or evidence of in-the-wild exploitation has been reported. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires high attack complexity (the attacker must know or guess valid metacharacter-adjacent paths on an already-allowed host) and no privileges or user interaction. The vulnerability was reported by researcher @sec-reex as part of an incomplete-patch measurement study via responsible disclosure (GitHub Advisory).

1. Identify a target site: Find an Astro site deployed on Netlify using @astrojs/netlify version ≤ 8.1.1 with image.remotePatterns configured with a literal pathname containing a . (e.g., /img/v1.0/file).
2. Inspect the generated allowlist: Retrieve or infer the contents of .netlify/v1/config.json to understand the generated regex under images.remote_images (e.g., https://cdn\.example\.com(:[0-9]+)?(\/img/v1.0/file)([?][^#]*)?$).
3. Craft a bypass URL: Construct an image URL on the allowed host that matches the overly-broad regex but not the intended pattern — for example, replacing . with any character (/img/v1X0/file) or crossing a path segment (/img/v1/0/file).
4. Request CDN optimization: Submit the crafted URL to Netlify's Image CDN optimization endpoint (e.g., /.netlify/images?url=https://cdn.example.com/img/v1X0/file). The CDN accepts and optimizes the request because the generated regex matches, bypassing the developer's intended path restriction (GitHub Advisory).

• Network: Unexpected Netlify Image CDN optimization requests (e.g., /.netlify/images?url=...) for image URLs at paths not explicitly listed in image.remotePatterns, particularly paths with character substitutions adjacent to . characters in version strings or file extensions.
• Logs: Netlify access logs showing CDN image optimization requests for URLs on allowed hosts but at unintended pathnames (e.g., /img/v1X0/file or /img/v1/0/file when only /img/v1.0/file was declared).
• File System: Review .netlify/v1/config.json — if images.remote_images entries contain unescaped . characters within the pathname portion of the regex (outside the hostname section), the site is vulnerable.

Upgrade @astrojs/netlify to version 8.1.2 or later, which escapes all regex metacharacters in the literal portions of each remotePatterns component before interpolation and validates generated Netlify regexes against matchPattern(). As a temporary workaround, avoid using regex metacharacters (especially .) in image.remotePatterns[].pathname values — for example, restructure paths to avoid version strings with dots — or restrict the allowed host so that unintended paths are not reachable on that origin (GitHub Advisory).

The vulnerability was reported by researcher @sec-reex as part of a responsible disclosure study focused on measuring incomplete patches, noting it as a residual of the same bug class as CVE-2026-54300. The Astro maintainer matthewp published the advisory. No significant broader media coverage or community discussion has been identified beyond the GitHub advisory (GitHub Advisory).