{"action":"Upgrade @astrojs/netlify to 8.1.2 or later.","affected":[{"fixed":"8.1.2","introduced":"0"}],"component":"@astrojs/netlify","cve_ids":["CVE-2026-73425"],"ecosystem":"npm","epss":0.00269,"exploited":false,"fixed_versions":["8.1.2"],"ghsa_id":"GHSA-hp3v-mfqw-h74c","id":"tcs_01M5KFVMKGB5W757N9WBC1B4D8","modified_at":"2026-08-13T15:30:07.980731689Z","published_at":"2026-07-20T23:24:34Z","references":["https://osv.dev/vulnerability/GHSA-hp3v-mfqw-h74c","https://github.com/withastro/astro/security/advisories/GHSA-hp3v-mfqw-h74c","https://nvd.nist.gov/vuln/detail/CVE-2026-73425","https://github.com/withastro/astro/pull/17018","https://github.com/withastro/astro/pull/17368","https://github.com/withastro/astro/commit/ee74c289bfe32fb6a7f59ed97c5c22db16394b72","https://github.com/advisories/GHSA-529g-xq4f-cw38","https://github.com/withastro/astro","https://github.com/withastro/astro/releases/tag/@astrojs/netlify@8.1.2"],"severity":{"label":"low","score":3.7},"sources":[{"source":"osv","source_id":"GHSA-hp3v-mfqw-h74c","url":"https://osv.dev/vulnerability/GHSA-hp3v-mfqw-h74c"}],"summary":"@astrojs/netlify generates an overly-broad Netlify Image CDN allowlist because remotePatterns.pathname metacharacters are not escaped"}