CVE-2026-73425: 
JavaScript vulnerability analysis and mitigation

CVE-2026-73425 is an incorrect regular expression vulnerability in the @astrojs/netlify adapter for the Astro web framework. Prior to version 8.1.2, the adapter generates an overly-broad Netlify Image CDN allowlist because remotePatterns.pathname values are interpolated into regular expressions without escaping regex metacharacters. This allows unauthenticated remote attackers to request CDN optimization of image URLs on an already-allowed host that the developer's remotePatterns configuration was intended to exclude. Affected versions are all releases up to and including 8.1.1; the fix is available in 8.1.2. The vulnerability carries a CVSS v3.1 base score of 3.7 (Low) (GitHub Advisory).

The root cause is classified as CWE-185 (Incorrect Regular Expression). In packages/integrations/netlify/src/index.ts, the remotePatternToRegex() function correctly escapes dots in hostname values (hostname.replace(/\./g, '\\.')) but interpolates the literal pathname value directly into the regex string without escaping metacharacters such as ., +, ?, (, and [. For example, the exact-match branch produces regexStr += '(\\${pathname})', leaving any metacharacter in the path raw. Because . in a regex matches any character including /, a pathname like /img/v1.0/file silently widens to match paths such as /img/v1X0/file or /img/v1/0/file. Netlify's Image CDN enforces the generated regex directly, and Astro's matchPattern() helper is not invoked for this code path, so there is no compensating validation layer. This issue is a residual of the same bug class partially addressed in CVE-2026-54300 (PR #17018), where wildcard semantics and a $ anchor were added but metacharacter escaping for literal pathnames was omitted (GitHub Advisory).

Successful exploitation allows an attacker to cause Netlify's Image CDN to optimize remote images at URLs on an already-allowed host that the developer's remotePatterns configuration was intended to restrict. The hostname remains correctly anchored, so the broadening is confined to the pathname dimension. Realistic impact depends on whether unintended images exist at metacharacter-adjacent paths on the allowed host; any pathname containing a . (e.g., file extensions or version segments) is affected. There is no integrity or availability impact, and no risk of lateral movement or code execution — the consequence is limited to unauthorized CDN image optimization and potential minor confidentiality exposure of images the developer intended to exclude (GitHub Advisory).

No public exploit code or in-the-wild exploitation has been reported for this vulnerability. The NVD SSVC assessment classifies exploitation as "none" and the attack as non-automatable, reflecting the high attack complexity required. The EPSS score is approximately 0.0017 (0.17%), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory).

1. Identify a target site: Find a site deployed on Netlify using the @astrojs/netlify adapter (version ≤ 8.1.1) with image.remotePatterns configured with a literal pathname containing a regex metacharacter such as . (e.g., /img/v1.0/file).
2. Inspect the generated allowlist: Retrieve or infer the contents of .netlify/v1/config.json (if accessible) to identify the generated images.remote_images regex, e.g., https://cdn\.example\.com(:[0-9]+)?(\/img/v1.0/file)([?][^#]*)?$.
3. Craft a bypass URL: Construct a URL on the allowed host that matches the unescaped regex but was not intended to be allowed — for example, replacing the . in /img/v1.0/file with any character (/img/v1X0/file) or a path separator (/img/v1/0/file).
4. Request CDN optimization: Submit an image optimization request to Netlify's Image CDN using the crafted bypass URL. The CDN enforces the regex directly and will accept and optimize the image, bypassing the developer's intended restriction (GitHub Advisory).

• Network: Netlify Image CDN optimization requests for URLs on an allowed host that do not exactly match the configured remotePatterns.pathname (e.g., paths with substituted characters or extra path segments where a . was expected).
• Logs: Netlify access logs showing image optimization requests for unexpected paths on an allowed hostname that differ from the exact pathname declared in image.remotePatterns.
• Configuration: Presence of @astrojs/netlify version ≤ 8.1.1 in package.json or package-lock.json; .netlify/v1/config.json containing images.remote_images entries with unescaped regex metacharacters in the pathname portion (GitHub Advisory).

Upgrade @astrojs/netlify to version 8.1.2 or later, which escapes all regex metacharacters in literal remotePatterns components before interpolation. As a workaround for those unable to upgrade immediately, avoid using regex metacharacters (notably .) in image.remotePatterns[].pathname values, or scope the allowed host so that unintended paths are not reachable on that host. Rebuilding and redeploying the site after upgrading is required to regenerate the corrected .netlify/v1/config.json allowlist (GitHub Advisory).

The vulnerability was reported by researcher @sec-reex as part of an incomplete-patch measurement study under responsible disclosure. The GitHub Security Advisory notes it is a residual of the same bug class as CVE-2026-54300, highlighting the challenge of fully remediating regex-generation issues in a single patch. No significant broader media coverage or social media discussion has been identified (GitHub Advisory).