CVE-2026-33769

Description

Astro is a web framework. From version 2.10.10 to before version 5.18.1, this issue concerns Astro's remotePatterns path enforcement for remote URLs used by server-side fetchers such as the image optimization endpoint. The path matching logic for /* wildcards is unanchored, so a pathname that contains the allowed prefix later in the path can still match. As a result, an attacker can fetch paths outside the intended allowlisted prefix on an otherwise allowed host. This issue has been patched in version 5.18.1.

PUBLISHED Reserved 2026-03-23 | Published 2026-03-24 | Updated 2026-03-24 | Assigner GitHub_M

Problem types

CWE-20: Improper Input Validation

Product status

References

github.com/.../astro/security/advisories/GHSA-g735-7g2w-hh3f

cve.org (CVE-2026-33769)

nvd.nist.gov (CVE-2026-33769)

Download JSON