Vulnerability Advisory: @astrojs/netlify Regex Bypass in Image Remote Patterns (GHSA-529g-xq4f-cw38)

Vulnerability Summary for @astrojs/netlify Vulnerability Overview Vulnerability Name: GHSA-529g-xq4f-cw38 Description: uses looser semantics when converting Astro's to Netlify's regular expressions. A single wildcard hostname such as is converted into an optional subdomain match, resulting in an apex host match. A single wildcard path such as is converted without an ending anchor, leading to deeper prefix path matches. Severity: Medium (5.3 / 10) Affected Scope Affected Versions: Fixed Version: Remediation Fixed Version: Upgrade to or later. Fix Details: The fix generates regular expressions that strictly match Astro's canonical and semantics, anchoring the full URL match instead of using looser matching. Specifically, should only match a single subdomain and should not match ; should only match a single additional path segment and should not match . POC Code ```markdown 1. Create an Astro app using astro@0.28 and @astrojs/netlify@0.7.10. 2. Configure Netlify output and a restrictive image pattern, for example remotePatterns: [{ protocol: 'http', hostname: '.localhost', pathname: '//a' }]. 3. Build the app and observe that _netlify/v1/config.json contains http://{{[a-z0-9-]+\.\}?localhost:[0-9]+}}//a{[a-z0-9-]+\.\}?localhost:[0-9]+}}//a{[a-z0-9-]+\.\}?localhost:[0-9]+}}//a{[a-z0-9-]+\.\}?localhost:[0-9]+}}//a{[a-z0-9-]+\.\}?localhost:[0-9]+}}//a{[a-z0-9-]+\.\}?localhost:[0-9]+}}//a{[a-z0-9-]+\.\}?localhost:[0-9]+}}//a{[a-z0-9-]+\.\}?localhost:[0-9]+}}//a{[a-z0-9-]+\.\}?localhost:[0-9]+}}//a{[a-z0-9-]+\.\}?localhost:[0-9]+}}//a{[a-z0-9-]+\.\}?localhost:[0-9]+}}//a{[a-z0-9-]+\.\}?localhost:[0-9]+}}//a{[a-z0-9-]+\.\}?localhost:[0-9]+}}//a{[a-z0-9-]+\.\}?localhost:[0-9]+}}//a{[a-z0-9-]+\.\}?localhost:[0-9]+}}//a{[a-z0-9-]+\.\}?localhost:[0-9]+}}//a{[a-z0-9-]+\.\}?localhost:[0-9]+}}//a{[a-z0-9-]+\.\}?localhost:[0-9]+}}//a{[a-z0-9-]+\.\}?localhost:[0-9]+}}//a{[a-z0-9-]+\.\}?localhost:[0-9]+}}//a{[a-z0-9-]+\.\}?localhost:[0-9]+}}//a{[a-z0-9-]+\.\}?localhost:[0-9]+}}//a{[a-z0-9-]+\.\}?localhost:[0-9]+}}//a{[a-z0-9-]+\.\}?localhost:[0-9]+}}//a{[a-z0-9-]+\.\}?localhost:[0-9]+}}//a{[a-z0-9-]+\.\}?localhost:[0-9]+}}//a{[a-z0-9-]+\.\}?localhost:[0-9]+}}//a{[a-z0-9-]+\.\}?localhost:[0-9]+}}//a{[a-z0-9-]+\.\}?localhost:[0-9]+}}//a{[a-z0-9-]+\.\}?localhost:[0-9]+}}//a{[a-z0-9-]+\.\}?localhost:[0-9]+}}//a{[a-z0-9-]+\.\}?localhost:[0-9]+}}//a{[a-z0-9-]+\.\}?localhost:[0-9]+}}//a{[a-z0-9-]+\.\}?localhost:[0-9]+}}//a{[a-z0-9-]+\.\}?localhost:[0-9]+}}//a{[a-z0-9-]+\.\}?localhost:[0-9]+}}//a{[a-z0-9-]+\.\}?localhost:[0-9]+}}//a{[a-z0-9-]+\.\}?localhost:[0-9]+}}//a{[a-z0-9-]+\.\}?localhost:[0-9]+}}//a{[a-z0-9-]+\.\}?localhost:[0-9]+}}//a{[a-z0-9-]+\.\}?localhost:[0-9]+}}//a{[a-z0-9-]+\.\}?localhost:[0-9]+}}//a{[a-z0-9-]+\.\}?localhost:[0-9]+}}//a{[a-z0-9-]+\.\}?localhost:[0-9]+}}//a{[a-z0-9-]+\.\}?localhost:[0-9]+}}//a{[a-z0-9-]+\.\}?localhost:[0-9]+}}//a{[a-z0-9-]+\.\}?localhost:[0-9]+}}//a{[a-z0-9-]+\.\}?localhost:[0-9]+}}//a{[a-z0-9-]+\.\}?localhost:[0-9]+}}//a{[a-z0-9-]+\.\}?localhost:[0-9]+}}//a{[a-z0-9-]+\.\}?localhost:[0-9]+}}//a{[a-z0-9-]+\.\}?localhost:[0-9]+}}//a{[a-z0-9-]+\.\}?localhost:[0-9]+}}//a{[a-z0-9-]+\.\}?localhost:[0-9]+}}//a{[a-z0-9-]+\.\}?localhost:[0-9]+}}//a{[a-z0-9-]+\.\}?localhost:[0-9]+}}//a{[a-z0-9-]+\.\}?localhost:[0-9]+}}//a{[a-z0-9-]+\.\}?localhost:[0-9]+}}//a{[a-z0-9-]+\.\}?localhost:[0-9]+}}//a{[a-z0-9-]+\.\}?localhost:[0-9]+}}//a{[a-z0-9-]+\.\}?localhost:[0-9]+}}//a{[a-z0-9-]+\.\}?localhost:[0-9]+}}//a{[a-z0-9-]+\.\}?localhost:[0-9]+}}//a{[a-z0-9-]+\.\}?localhost:[0-9]+}}//a{[a-z0-9-]+\.\}?localhost:[0-9]+}}//a{[a-z0-9-]+\.\}?localhost:[0-9]+}}//a{[a-z0-9-]+\.\}?localhost:[0-9]+}}//a{[a-z0-9-]+\.\}?localhost:[0-9]+}}//a{[a-z0-9-]+\.\}?localhost:[0-9]+}}//a{[a-z0-9-]+\.\}?localhost:[0-9]+}}//a{[a-z0-9-]+\.\}?localhost:[0-9]+}}//a{[a-z0-9-]+\.\}?localhost:[0-9]+}}//a{[a-z0-9-]+\.\}?localhost:[0-9]+}}//a{[a-z0-9-]+\.\}?localhost:[0-9]+}}//a{[a-z0-9-]+\.\}?localhost:[0-9]+}}//a{[a-z0-9-]+\.\}?localhost:[0-9]+}}//a{[a-z0-9-]+\.\}?localhost:[0-9]+}}//a{[a-z0-9-]+\.\}?localhost:[0-9]+}}//a{[a-z0-9-]+\.\}?localhost:[0-9]+}}//a{[a-z0-9-]+\.\}?localhost:[0-9]+}}//a{[a-z0-9-]+\.\}?localhost:[0-9]+}}//a{[a-z0-9-]+\.\}?localhost:[0-9]+}}//a{[a-z0-9-]+\.\}?localhost:[0-9]+}}//a{[a-z0-9-]+\.\}?localhost:[0-9]+}}//a{[a-z0-9-]+\.\}?localhost:[0-9]+}}//a{[a-z0-9-]+\.\}?localhost:[0-9]+}}//a{[a-z0-9-]+\.\}?localhost:[0-9]+}}//a{[a-z0-9-]+\.\}?localhost:[0-9]+}}//a{[a-z0-9-]+\.\}?localhost:[0-9]+}}//a{[a-z0-9-]+\.\}?localhost:[0-9]+}}//a{[a-z0-9-]+\.\}?localhost:[0-9]+}}//a{[a-z0-9-]+\.\}?localhost:[0-9]+}}//a{[a-z0-9-]+\.\}?localhost:[0-9]+}}//a{[a-z0-9-]+\.\}?localhost:[0-9]+}}//a{[a-z0-9-]+\.\}?localhost:[0-9]+}}//a{[a-z0-9-]+\.\}?localhost:[0-9]+}}//a{[a-z0-9-]+\.\}?localhost:[0-9]+}}//a{[a-z0-9-]+\.\}?localhost:[0-9]+}}//a{[a-z0-9-]+\.\}?localhost:[0-9]+}}//a{[a-z0-9-]+\.\}?localhost:[0-9]+}}//a{[a-z0-9-]+\.\}?localhost:[0-9]+}}//a{[a-z0-9-]+\.\}?localhost:[0-9]+}}//a{[a-z0-9-]+\.\}?localhost:[0-9]+}}//a{[a-z0-

Goal Reached Thanks to every supporter — we hit 100%!

Vulnerability Advisory: @astrojs/netlify Regex Bypass in Image Remote Patterns (GHSA-529g-xq4f-cw38)

More from this source