[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@astrojs/node (source)	11.1.11 → 11.1.12

---

Astro: Image endpoint in @​astrojs/node can read files from a case-variant sibling of the output directory on case-sensitive filesystems

CVE-2026-126364 / GHSA-r3h5-4585-7x3w

More information

Details

Summary

The /_image endpoint used by the @astrojs/node adapter checks that a requested local image is inside the build output directory before reading it from disk. That check compared paths case-insensitively. On case-sensitive filesystems (such as Linux), a directory whose path differs from the output directory only by letter case is a different directory, but it passed the check.

For example, with the client output directory at /srv/app/dist/client/, a request such as:

/_image?href=/../../DIST/client/secret.png&w=32&f=png

resolved to /srv/app/DIST/client/secret.png and was served, even though that file is outside the output directory.

Impact

An unauthenticated attacker can read image files from outside the output directory, but only when all of the following are true:

• The site uses on-demand rendering with the @astrojs/node adapter.
• The server runs on a case-sensitive filesystem.
• A directory exists whose path matches the output directory except for letter case (for example DIST/client next to dist/client). Such a layout is unusual, and the attacker cannot create it.

Only files the image service accepts can be read. Raster images are returned after resizing; SVG files are returned unchanged. Other file types fail during processing. Plain path traversal outside the output directory (for example /../../secret.png) was already rejected and is not affected.

Affected versions

astro >= 5.14.3, <= 7.4.6, when used with @astrojs/node (all versions up to 11.1.11). The vulnerable image endpoint is provided by astro and used by the @astrojs/node adapter.

Patches

Fixed in astro 7.4.7. The path check now compares paths exactly, and only ignores letter case for Windows drive-letter paths. The fix ships in astro, so upgrading @astrojs/node alone is not enough.

Workarounds

Upgrade to astro 7.4.7 or later. Before upgrading, make sure no directory next to the build output directory has a path that differs from it only by letter case.

Credits

Reported by @​zachariah-mithani.

Severity

• CVSS Score: 6.3 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References

• https://github.com/withastro/astro/security/advisories/GHSA-r3h5-4585-7x3w
• https://nvd.nist.gov/vuln/detail/CVE-2026-126364
• https://github.com/withastro/astro/commit/7da442bb286e0c29e1c9e1add6727b7cbf434f1a
• https://github.com/withastro/astro
• https://github.com/withastro/astro/releases/tag/astro@7.4.7

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

withastro/astro (@​astrojs/node)

v11.1.12

Compare Source

Patch Changes

• Updated dependencies [57137ed]:
  • @​astrojs/internal-helpers@0.13.2

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.