{"action":"Upgrade @astrojs/node to 9.5.4 or later.","affected":[{"fixed":"9.5.4","introduced":"9.0.0"}],"component":"@astrojs/node","cve_ids":["CVE-2026-27829"],"ecosystem":"npm","epss":0.00422,"exploited":false,"fixed_versions":["9.5.4"],"ghsa_id":"GHSA-cj9f-h6r6-4cx2","id":"tcs_01M5KFK03FZYZS3FHS3XSHWRM5","modified_at":"2026-02-28T05:13:56.361896Z","published_at":"2026-02-25T18:11:47Z","references":["https://osv.dev/vulnerability/GHSA-cj9f-h6r6-4cx2","https://github.com/withastro/astro/security/advisories/GHSA-cj9f-h6r6-4cx2","https://nvd.nist.gov/vuln/detail/CVE-2026-27829","https://github.com/withastro/astro/commit/e01e98b063e90d274c42130ec2a60cc0966622c9","https://github.com/withastro/astro"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"GHSA-cj9f-h6r6-4cx2","url":"https://osv.dev/vulnerability/GHSA-cj9f-h6r6-4cx2"}],"summary":"Astro is vulnerable to SSRF due to missing allowlist enforcement in remote image inferSize"}