---
cve: "CVE-2026-27829"
severity: "MEDIUM"
cvss: 6.5
epss: "28%"
vendor: "withastro"
kev: false
exploited: false
published: "2026-02-26 01:16:24"
tags: [cve, security, medium]
source: tsecurity.de CVE-Dossier
exported: "2026-09-06T14:39:39+02:00"
---

# CVE-2026-27829

> 6.5 MEDIUM · 🧪 PoC

## Beschreibung

Astro is a web framework. In versions 9.0.0 through 9.5.3, a bug in Astro's image pipeline allows bypassing `image.domains` / `image.remotePatterns` restrictions, enabling the server to fetch content from unauthorized remote hosts. Astro provides an `inferSize` option that fetches remote images at render time to determine their dimensions. Remote image fetches are intended to be restricted to domains the site developer has manually authorized (using the `image.domains` or `image.remotePatterns` options). However, when `inferSize` is used, no domain validation is performed — the image is fetched from any host regardless of the configured restrictions. An attacker who can influence the image URL (e.g., via CMS content or user-supplied data) can cause the server to fetch from arbitrary hosts. This allows bypassing `image.domains` / `image.remotePatterns` restrictions to make server-side requests to unauthorized hosts. This includes the risk of server-side request forgery (SSRF) against internal network services and cloud metadata endpoints. Version 9.5.4 fixes the issue.

## CVSS-Vektor

```
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Gering | bad |
| PR Privilegien | Keine | bad |
| UI Interaktion | Keine | bad |
| S Scope | Unverändert | good |
| C Vertraulichkeit | Keine | good |
| I Integrität | Gering | warn |
| A Verfügbarkeit | Gering | warn |

## Patch verfügbar (OSV)

- e0f1a2b3e4bc908bd5e148c698efb6f41a42c8ea (Commit)
- e01e98b063e90d274c42130ec2a60cc0966622c9 (Commit)

## Referenzen

- <https://github.com/withastro/astro/security/advisories/GHSA-cj9f-h6r6-4cx2>
- <https://github.com/withastro/astro/commit/e01e98b063e90d274c42130ec2a60cc0966622c9>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/cve?cve=CVE-2026-27829) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI BITS_