CVE-2026-41321: 
JavaScript vulnerability analysis and mitigation

CVE-2026-41321 is a Server-Side Request Forgery (SSRF) vulnerability in the @astrojs/cloudflare npm package, specifically in the image-binding-transform endpoint. The flaw arises because the fetch() call for remote images in packages/integrations/cloudflare/src/utils/image-binding-transform.ts (line 28) uses the default redirect: 'follow' behavior, allowing a Cloudflare Worker to follow HTTP redirects to arbitrary URLs and bypass the isRemoteAllowed() domain allowlist. It affects @astrojs/cloudflare versions ≤ 13.1.6 (patched in 13.1.10) and represents an incomplete fix for the prior advisory GHSA-qpr4-c339-7vq8. Disclosed on April 20, 2026, and published to the GitHub Advisory Database on April 23, 2026, it carries a CVSS v3.1 base score of 2.2 (Low) (GitHub Advisory, Astro Advisory).

The root cause is classified as CWE-918 (Server-Side Request Forgery). In image-binding-transform.ts at line 28, the code const content = await (isRemotePath(href) ? fetch(imageSrc) : assets.fetch(imageSrc)); omits the { redirect: 'manual' } option, unlike the three other image fetch paths in the codebase which all correctly specify redirect: 'manual'. An attacker who has high privileges can craft a request to the /_image endpoint using a URL on an allowed domain that issues a 302 redirect to an internal or otherwise unauthorized destination; the Worker follows the redirect transparently, bypassing the isRemoteAllowed() allowlist check that only validates the initial URL. Exploitation requires the attacker to identify an open redirect on a domain already present in the image.domains or image.remotePatterns allowlist (GitHub Advisory, Astro Advisory).

Successful exploitation enables blind SSRF, allowing the Cloudflare Worker to make requests to internal services or domains not permitted by the configured allowlist (image.domains / image.remotePatterns). While the CVSS score rates confidentiality and integrity impact as None, the practical risk includes potential access to internal network resources, metadata endpoints (e.g., cloud provider instance metadata), or other services reachable from the Worker's network context. The availability impact is rated Low, and the vulnerability does not directly enable data exfiltration or code execution on its own (GitHub Advisory).

No in-the-wild exploitation has been reported, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. A proof-of-concept demonstrating redirect-following behavior was included in the advisory itself, showing that a Node.js fetch() without redirect: 'manual' follows 302 redirects to arbitrary destinations. The EPSS score is approximately 0.033% (0.000330), placing it in the 15th percentile for exploitation likelihood. Exploitation requires high privileges and high attack complexity, significantly limiting practical risk (GitHub Advisory, Astro Advisory).

1. Identify target: Confirm the target Astro application uses @astrojs/cloudflare ≤ 13.1.6 with the default cloudflare-binding image service and has at least one domain configured in image.domains or image.remotePatterns.
2. Find an open redirect: Locate an open redirect vulnerability on one of the allowed domains (e.g., https://allowed-cdn.com/redirect?url=<destination>).
3. Craft the malicious request: Construct a request to the image optimization endpoint using the open redirect URL as the image source:

   GET /_image?href=https://allowed-cdn.com/redirect?url=http://internal-service/secret

4. Trigger redirect following: The Cloudflare Worker calls fetch('https://allowed-cdn.com/redirect?url=http://internal-service/secret') without redirect: 'manual', causing it to automatically follow the 302 redirect to http://internal-service/secret.
5. Achieve blind SSRF: The Worker fetches content from the unauthorized internal destination; while the response may not be directly returned to the attacker (blind SSRF), timing differences or error responses may reveal information about internal service availability (GitHub Advisory, Astro Advisory).

• Network: Unexpected outbound HTTP requests from the Cloudflare Worker to internal IP ranges or non-allowlisted domains, particularly following requests to the /_image endpoint with external href parameters.
• Logs: Cloudflare Worker logs showing fetch() calls to internal hostnames or IP addresses (e.g., 169.254.169.254, 10.x.x.x, 192.168.x.x) that were not directly specified in the original request.
• Application: Requests to /_image?href= containing URLs with redirect parameters pointing to internal services or unusual destinations; repeated requests to the image endpoint with URLs from allowed domains that include query parameters resembling redirect chains.

Upgrade @astrojs/cloudflare to version 13.1.10 or later, which applies the fix by adding { redirect: 'manual' } to the fetch() call in image-binding-transform.ts. The fix is: const content = await (isRemotePath(href) ? fetch(imageSrc, { redirect: 'manual' }) : assets.fetch(imageSrc));. As a temporary workaround, restrict the image.domains and image.remotePatterns allowlist to only domains fully under your control that are known not to have open redirects, reducing the attack surface until the patch can be applied (GitHub Advisory, Astro Advisory).