CVE-2026-102983

Executive Summary

CVE-2026-102983 is an unanchored regular expression vulnerability (CWE-625) in the @astrojs/netlify adapter for the Astro web framework, affecting versions 5.2.0 through 8.2.3. The adapter generates regex patterns for the Netlify Image CDN remote-image allowlist without anchoring them to the start of the URL, allowing an attacker-controlled host to satisfy image.domains or image.remotePatterns checks if an allowed origin string appears anywhere in the URL path or query. This enables unauthenticated attackers to make the public /.netlify/images endpoint request attacker-selected URLs, potentially probing internal services, though Netlify egress protections and image transformation limits constrain exploitation impact.

Technical Analysis

The vulnerability resides in how the @astrojs/netlify adapter constructs regular expressions used to validate remote image sources against the configured image.domains or image.remotePatterns allowlist. Specifically, the adapter fails to anchor these regex patterns to the beginning of the URL string (i.e., missing the ^ anchor). Netlify's Image CDN evaluates these regular expressions using the JavaScript RegExp.test() method, which returns true if the pattern matches anywhere within the input string, not just at the start.

This creates a logical flaw in the allowlist enforcement: an attacker can craft a URL where an allowed origin appears only within the path or query string, while the actual host portion of the URL points to an attacker-controlled domain. For example, if image.domains includes trusted.example.com, a URL such as https://attacker.com/trusted.example.com/image.jpg would pass the RegExp.test() check because the substring trusted.example.com appears in the path, even though the request would actually be made to attacker.com. Similarly, query parameters containing the allowed domain string would also satisfy the check.

The attack surface is the public /.netlify/images endpoint, which is unauthenticated and accessible to any client that can reach the Netlify-hosted site. When an image request is made to this endpoint, the Netlify Image CDN processes the request, parses the target URL, and—due to the unanchored regex—may fetch content from a host that was not intended to be allowed. This constitutes a server-side request forgery (SSRF)-like condition, where the Netlify infrastructure makes outbound requests on behalf of the attacker.

The practical impact is constrained by several factors. Netlify's egress protections may restrict which internal or external services are reachable, limiting the scope of SSRF. Additionally, the image transformation pipeline processes the fetched content as an image, and the direct response returned to the attacker is the transformed image (or an error), not the raw response body from the target URL. This limits direct data exfiltration. The NVD description explicitly states that no confidentiality or integrity impact has been demonstrated. The CVSS vector reflects this: network attack vector, low complexity, no privileges required, no user interaction, unchanged scope, and no impact on confidentiality, integrity, or availability (C:N/I:N/A:N), though the CVSS score itself is listed as N/A in the provided data.

The root cause is a common class of vulnerability: improper neutralization of special elements (CWE-625, "Regular Expression Denial of Service" is not the correct mapping here; the provided CWE is CWE-625, which is "Permissive Regular Expression"). CWE-625 is described as "The product uses a regular expression that does not sufficiently restrict the set of allowed values." This precisely matches the unanchored regex issue.

The fix in version 8.2.4 likely involves anchoring the regex patterns to the start of the input string (adding ^) and ensuring that hostname matching is performed against the parsed host component rather than the entire URL string. No public proof-of-concept or exploit code is available, and no Nuclei template exists. The patch confidence is 0/4, indicating that no patch evidence from tracked sources has been confirmed, though the NVD description states the issue is fixed in version 8.2.4.

Exploitation Scenarios

Given the absence of a public PoC and the sparse technical details, the following attack chain is inferred from the vulnerability class (permissive regular expression leading to SSRF) and the observable endpoint.

1. Reconnaissance/target identification: An attacker identifies a target web application built with Astro and deployed on Netlify using the @astrojs/netlify adapter in a vulnerable version (5.2.0 to 8.2.3). The attacker can determine this by inspecting HTTP response headers, static asset patterns, or the presence of the /.netlify/images endpoint. Shodan or similar internet-wide scanning services could be used to find such deployments by searching for the endpoint or Astro-specific signatures.

2. Triggering the flaw class: The attacker crafts a URL that will be passed to the Netlify Image CDN as the image source. The URL is constructed such that it begins with an attacker-controlled host, but includes an allowed origin string within its path or query. For example, if the site's image.domains allowlist contains example.com, the attacker might use https://attacker-controlled.com/example.com/evil.jpg or https://attacker-controlled.com/?param=example.com. The attacker then sends a request to the public /.netlify/images endpoint with this crafted URL as a parameter (the exact parameter name is not specified in the NVD description and is not invented here). The unanchored regex used by the adapter matches the allowed origin substring anywhere in the URL, so the request passes the allowlist check.

3. Payload/execution method: The Netlify Image CDN makes an outbound HTTP request to the attacker-specified URL (the actual host being attacker-controlled.com). The attacker controls this server and can log the incoming request, thereby confirming the SSRF. The attacker can also attempt to direct the request to internal services by using IP addresses or internal hostnames in the URL, although Netlify's egress protections may block such attempts. The image transformation pipeline will attempt to process the response as an image; if the response is not a valid image, an error may be returned, but the outbound request is still made.

4. Post-exploitation impact: The primary impact is the ability to probe internal networks or services from the Netlify infrastructure, potentially revealing the existence of internal services or causing side effects via crafted requests (e.g., triggering actions on internal APIs that lack authentication). However, the NVD description notes that no confidentiality or integrity impact has been demonstrated, and direct response exfiltration is limited because the attacker receives transformed image data or error messages, not the raw response body. The attacker could potentially use the SSRF to perform port scanning of internal IPs by observing timing differences or error messages, but again, egress protections may hinder this.

No public PoC is available; the attack chain is inferred from the vulnerability class.

Impact Assessment

The business impact of CVE-2026-102983 is relatively low based on the CVSS vector provided (C:N/I:N/A:N), which indicates no direct impact on confidentiality, integrity, or availability. The vulnerability allows for an SSRF-like condition, but practical exploitation is constrained by Netlify's egress protections and the image transformation pipeline. Affected systems are web applications built with Astro versions 5.2.0 through 8.2.3 that use the @astrojs/netlify adapter and have the Netlify Image CDN enabled with an allowlist configuration.

The blast radius includes any Netlify-hosted site using the vulnerable adapter version. However, because the impact is limited to the ability to make outbound requests from Netlify's infrastructure, the primary risk is to the internal network of Netlify or any services reachable from it, not to the confidentiality or integrity of the application's data. The lack of demonstrated confidentiality or integrity impact means that the vulnerability is unlikely to lead to direct data breaches. Availability impact is also none, as the image CDN is designed to handle requests and the SSRF does not cause denial of service.

From a business perspective, the main concern is potential reputational damage if the vulnerability were exploited to probe internal services, and the possibility of using the SSRF as a stepping stone for further attacks if egress protections are bypassed. However, given the constraints, the overall risk is low. Organizations should still patch promptly to eliminate the vulnerability.

Detection Guidance

Sigma Rule

title: Astro Netlify Image CDN Unanchored Regex SSRF Attempt
id: 8f4b2c1e-9a3d-4f7b-8c2e-1d5a6b7c8d9e
status: experimental
description: Detects requests to the Netlify Image CDN endpoint with a URL parameter containing an allowed origin in the path or query while the host is not the allowed origin.
author: Threat Intelligence
date: 2026-05-12
logsource:
  category: webserver
  product: netlify
detection:
  selection:
    cs-method: 'GET'
    cs-uri-stem: '/.netlify/images'
    cs-uri-query|contains:
      - 'url='
      - 'src='
  filter_legit:
    cs-uri-query|contains:
      - 'url=https://trusted.example.com'
      - 'url=https://cdn.example.com'
  condition: selection and not filter_legit
fields:
  - c-ip
  - cs-uri-query
falsepositives:
  - Legitimate image requests with allowed domains in query parameters for other reasons.
level: medium

YARA Rule

rule CVE_2026_102983_Astro_Netlify_SSRF
{
    meta:
        description = "Detects URLs crafted to exploit unanchored regex in Astro Netlify adapter"
        author = "Threat Intelligence"
        date = "2026-05-12"
        reference = "CVE-2026-102983"
        severity = "medium"
    strings:
        $netlify_endpoint = "/.netlify/images"
        $param_url = "url="
        $param_src = "src="
        $http = "http"
    condition:
        $netlify_endpoint and ($param_url or $param_src) and $http
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-102983 Astro Netlify Image CDN SSRF Attempt"; flow:to_server,established; http.uri; content:"/.netlify/images"; http.uri; content:"url="; http.uri; pcre:"/url=(https?:\/\/[^\/]+\/[^&]*?(?:[a-zA-Z0-9-]+\.)+[a-zA-Z]{2,})/i"; classtype:attempted-recon; sid:10000001; rev:1;)

Elastic Detection

network where
  url.path == "/.netlify/images" and
  url.query contains "url=" and
  not url.query contains "url=https://trusted.example.com"

Splunk SPL Query

index=web sourcetype=access_combined
uri_path="/.netlify/images" uri_query="*url=*"
| where NOT match(uri_query, "url=https://trusted\.example\.com")
| stats count by clientip, uri_query
| where count > 5

Wazuh OSSEC Rule

<group name="web,appsec,">
  <rule id="100001" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <url>/.netlify/images</url>
    <match>url=</match>
    <regex>url=https?:\/\/[^\/]+\/.*(?:trusted\.example\.com|cdn\.example\.com)</regex>
    <description>CVE-2026-102983: Possible Astro Netlify Image CDN SSRF attempt</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

   • If using the @astrojs/netlify adapter in versions 5.2.0 through 8.2.3, immediately review the image.domains and image.remotePatterns configuration. Ensure that the allowlist contains only domains you fully trust and control.
   • Consider disabling the Netlify Image CDN remote image feature if it is not essential, or restrict it to a minimal set of trusted origins.
   • Implement additional network-level controls to monitor or block outbound requests from the Netlify Image CDN to unexpected hosts, if possible. However, Netlify's infrastructure is managed, so this may not be directly configurable.
   • Monitor access logs for requests to /.netlify/images with unusual URL parameters that contain allowed domains in the path or query but point to different hosts.

2. Patch/upgrade steps:

   • Upgrade the @astrojs/netlify adapter to version 8.2.4 or later, which contains the fix for this vulnerability. The fix likely anchors the regular expressions to the start of the URL and may parse the host component correctly.
   • After upgrading, verify that the allowlist enforcement works as expected by testing with crafted URLs.
   • Since the patch confidence is 0/4, confirm the availability and integrity of the patch from the official Astro repository or npm package registry before applying.

3. Long-term hardening:

   • Always anchor regular expressions used for security validation to the beginning (and end) of the input string to prevent substring matching.
   • Prefer parsing URLs into components and validating the host against an exact allowlist rather than using regex on the full URL string.
   • Conduct regular security reviews of third-party adapters and integrations, especially those that make outbound requests based on user input.
   • Implement defense-in-depth by restricting egress traffic from serverless functions and CDN edge workers to only necessary destinations.
   • Keep all dependencies up to date and subscribe to security advisories for Astro and its adapters.

References

• NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-102983
• Astro Security Advisory: (No official advisory URL provided in the data; refer to the Astro GitHub repository for security releases)
• Netlify Image CDN Documentation: https://docs.netlify.com/image-cdn/overview/
• CWE-625: Permissive Regular Expression: https://cwe.mitre.org/data/definitions/625.html
• CISA KEV Catalog: Not applicable (CVE not listed in KEV as of this report)

No known threat actor campaigns or exploit-in-the-wild evidence have been observed for this vulnerability.