CVE-2026-33769 - Astro: Remote allowlist bypass via unanchored matchPathname wildcard

Back Back to CVE browser

LOW

Astro: Remote allowlist bypass via unanchored matchPathname wildcard

Published Mar 24, 2026

2.9

LOW

CVSS 4.0

EPSS 0.36%

Description

Astro is a web framework. From version 2.10.10 to before version 5.18.1, this issue concerns Astro's remotePatterns path enforcement for remote URLs used by server-side fetchers such as the image optimization endpoint. The path matching logic for /* wildcards is unanchored, so a pathname that contains the allowed prefix later in the path can still match. As a result, an attacker can fetch paths outside the intended allowlisted prefix on an otherwise allowed host. This issue has been patched in version 5.18.1.

Affected products

Vendor Withastro Product Astro Default
unknown
Affected
- ≥ 2.10.10, < 5.18.1

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Withastro	Astro	unknown	Affected ≥ 2.10.10, < 5.18.1

Ecosystem	Package	Introduced	Fixed
npm	astro	2.10.10	5.18.1

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-183

CWE-20

Improper Input Validation

References (4)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-14984
Advisory
https://github.com/advisories/GHSA-g735-7g2w-hh3f
Advisory
https://github.com/withastro/astro/security/advisories/GHSA-g735-7g2w-hh3f
x_refsource_CONFIRMExploitVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-33769

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-14984		Advisory
https://github.com/advisories/GHSA-g735-7g2w-hh3f		Advisory
https://github.com/withastro/astro/security/advisories/GHSA-g735-7g2w-hh3f		x_refsource_CONFIRMExploitVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-33769