CVE-2026-27829
1 advisory.
npm/@astrojs/node CVE-2026-27829: medium 6.5, EPSS 0.42%
Astro is vulnerable to SSRF due to missing allowlist enforcement in remote image inferSize
Action: Upgrade @astrojs/node to 9.5.4 or later.
npm i @astrojs/node@9.5.4Affected
| introduced | fixed | last affected |
|---|---|---|
| 9.0.0 | 9.5.4 | - |
Fixed versions
| 9.5.4 |
Sources
- osv: GHSA-cj9f-h6r6-4cx2
- https://github.com/withastro/astro/security/advisories/GHSA-cj9f-h6r6-4cx2
- https://nvd.nist.gov/vuln/detail/CVE-2026-27829
- https://github.com/withastro/astro/commit/e01e98b063e90d274c42130ec2a60cc0966622c9
- https://github.com/withastro/astro
CVE-2026-27829 · published · modified · JSON