CVE-2026-27829

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-27829
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-27829.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-27829
Aliases
Published
2026-02-26T00:36:40Z
Modified
2026-08-12T03:51:42Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L CVSS Calculator
Summary
Astro is vulnerable to SSRF due to missing allowlist enforcement in remote image inferSize
Details

Astro is a web framework. In versions 9.0.0 through 9.5.3, a bug in Astro's image pipeline allows bypassing image.domains / image.remotePatterns restrictions, enabling the server to fetch content from unauthorized remote hosts. Astro provides an inferSize option that fetches remote images at render time to determine their dimensions. Remote image fetches are intended to be restricted to domains the site developer has manually authorized (using the image.domains or image.remotePatterns options). However, when inferSize is used, no domain validation is performed — the image is fetched from any host regardless of the configured restrictions. An attacker who can influence the image URL (e.g., via CMS content or user-supplied data) can cause the server to fetch from arbitrary hosts. This allows bypassing image.domains / image.remotePatterns restrictions to make server-side requests to unauthorized hosts. This includes the risk of server-side request forgery (SSRF) against internal network services and cloud metadata endpoints. Version 9.5.4 fixes the issue.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-918"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27829.json"
}
References

Affected packages

Git / github.com/withastro/astro

Affected ranges

Type
GIT
Repo
https://github.com/withastro/astro
Events
Introduced
f55ba4caca7c587555da86e3211ae1f1b3407c5f
Fixed
e0f1a2b3e4bc908bd5e148c698efb6f41a42c8ea
Fixed
e01e98b063e90d274c42130ec2a60cc0966622c9
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:astro:\\@astrojs\\/node:*:*:*:*:*:node.js:*:*",
    "extracted_events": [
        {
            "introduced": "9.0.0"
        },
        {
            "fixed": "9.5.4"
        }
    ],
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-27829.json"