CVE-2026-33769
Medium · 5.3CVSS
5.3
EPSS
0.4%
Published
Mar 24, 2026
CISA due date
—
The record
Astro is a web framework. From version 2.10.10 to before version 5.18.1, this issue concerns Astro's remotePatterns path enforcement for remote URLs used by server-side fetchers such as the image optimization endpoint. The path matching logic for /* wildcards is unanchored, so a pathname that contains the allowed prefix later in the path can still match. As a result, an attacker can fetch paths outside the intended allowlisted prefix on an otherwise allowed host. This issue has been patched in version 5.18.1.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | astro | 2.10.10 | 5.18.1 |
Related vulnerabilities
- GHSA-g735-7g2w-hh3f Astro: Remote allowlist bypass via unanchored matchPathname wildcard Same vulnerability
- CVE-2026-54298 Astro is a web framework. Also affects astro
- CVE-2026-54299 Astro is a web framework. Also affects astro
- CVE-2026-50146 Astro is a web framework. Also affects astro
- GHSA-jrpj-wcv7-9fh9 Astro: XSS via Unescaped Attribute Names in Spread Props Also affects astro
- GHSA-2pvr-wf23-7pc7 Astro: Host header SSRF in prerendered error page fetch Also affects astro
- GHSA-8hv8-536x-4wqp Astro: Reflected XSS via unescaped slot name Also affects astro
- CVE-2026-45028 Astro is a web framework. Also affects astro