PT-2026-34823 · Astro · @Astrojs/Cloudflare

Published 2026-04-23 · Updated 2026-04-24 · CVE-2026-41321

Positive Technologies (AI Summary)

CVSS v3.1

2.2

Low

Base vector

AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions @astrojs/cloudflare versions prior to 13.1.10

Description The fetch() call for remote images in 'packages/integrations/cloudflare/src/utils/image-binding-transform.ts' uses the default redirect: 'follow' behavior. This allows the Cloudflare Worker to follow HTTP redirects to arbitrary URLs, bypassing the isRemoteAllowed() domain allowlist check which only validates the initial URL. This issue enables blind Server-Side Request Forgery (SSRF), where an attacker can use an open redirect on an allowed domain to reach unauthorized internal destinations, bypassing the image.domains and image.remotePatterns allowlists.

Recommendations Update to version 13.1.10.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-41321

GHSA-88GM-J2WX-58H6

Affected Products

@Astrojs/Cloudflare

References · 8

• 🔥 https://github.com/withastro/astro/security/advisories/GHSA-88gm-j2wx-58h6 · Exploit
• https://osv.dev/vulnerability/GHSA-88gm-j2wx-58h6 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41321 · Security Note
• https://github.com/withastro/astro · Note
• https://github.com/withastro/astro/commit/a43eb4b40b4f81530e3c9b5e2959495900320433 · Note
• https://github.com/withastro/astro/releases/tag/%40astrojs%2Fcloudflare%4013.1.10 · Note
• https://twitter.com/CVEnew/status/2047731889050374300 · Twitter Post
• https://github.com/advisories/GHSA-qpr4-c339-7vq8 · Note