Read the docs
TI-2026-29922 Aliases CVE-2026-41321GHSA-88gm-j2wx-58h6

@astrojs/cloudflare: SSRF via redirect following in Cloudflare image-binding-transform endpoint

Priority MEDIUM 45CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
None · None · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

@astrojs/cloudflare is an SSR adapter for use with Cloudflare Workers targets. Prior to 13.1.10, the fetch() call for remote images in packages/integrations/cloudflare/src/utils/image-binding-transform.ts uses the default redirect: 'follow' behavior. This allows the Cloudflare Worker to follow HTTP redirects to arbitrary URLs, bypassing the isRemoteAllowed() domain allowlist check which only validates the initial URL. This vulnerabiity is caused by an incomplete fix for CVE-2025-58179. This vulnerability is fixed in 13.1.10.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00242 15th percentileScored 2026-11-07
Fix Fixed @astrojs/cloudflare (withastro): 13.1.10@astrojs/cloudflare (npm): 13.1.10

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
withastro@astrojs/cloudflarebefore 13.1.1013.1.10Patch availableCNA
—@astrojs/cloudflare (npm)before 13.1.1013.1.10Patch availableGHSA-88gm-j2wx-58h6
  • @astrojs/cloudflare Vendorwithastro Affected before 13.1.10 Fixed in 13.1.10 Patch available CNA
  • @astrojs/cloudflare (npm) Vendor— Affected before 13.1.10 Fixed in 13.1.10 Patch available GHSA-88gm-j2wx-58h6

Remediation

  • Fix · CNA @astrojs/cloudflare (withastro) Fixed in 13.1.10
  • Fix · GHSA-88gm-j2wx-58h6 @astrojs/cloudflare (npm) Fixed in 13.1.10 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-41321
  2. 2026-10-03 Alias added: GHSA-88gm-j2wx-58h6

References

Advisory 2

Other 4

  • TI-2026-26147 Astro: Unauthenticated Path Override via `x-astro-path` / `x_astro_path` CVSS 3.1CRITICAL 9.1
  • TI-2026-42600 Astro 6.4.7 Authorization Bypass via Decode Iteration Limit and Rewrite Path Canonicalization Mismatch CVSS 3.1HIGH 8.2
  • TI-2024-37142 Server source code is exposed to the public if sourcemaps are enabled CVSS 4.0HIGH 7.8
  • TI-2025-35987 Astro Cloudflare adapter is vulnerable to Server-Side Request Forgery via /_image endpoint CVSS 3.1HIGH 7.2
  • TI-2025-34958 Unauthorized third-party images in Astro’s _image endpoint CVSS 4.0MEDIUM 6.9
  • TI-2026-51542 Astro: Unauthenticated path override in the @astrojs/vercel ISR function CVSS 3.1MEDIUM 6.5
See all 43 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences