Repository navigation
Update dependency @astrojs/node to v11.1.12 [SECURITY] - #2008
Merged
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
11.1.9→11.1.12Astro: Image endpoint in @astrojs/node can read files from a case-variant sibling of the output directory on case-sensitive filesystems
CVE-2026-126364 / GHSA-r3h5-4585-7x3w
More information
Details
Summary
The
/_imageendpoint used by the@astrojs/nodeadapter checks that a requested local image is inside the build output directory before reading it from disk. That check compared paths case-insensitively. On case-sensitive filesystems (such as Linux), a directory whose path differs from the output directory only by letter case is a different directory, but it passed the check.For example, with the client output directory at
/srv/app/dist/client/, a request such as:resolved to
/srv/app/DIST/client/secret.pngand was served, even though that file is outside the output directory.Impact
An unauthenticated attacker can read image files from outside the output directory, but only when all of the following are true:
@astrojs/nodeadapter.DIST/clientnext todist/client). Such a layout is unusual, and the attacker cannot create it.Only files the image service accepts can be read. Raster images are returned after resizing; SVG files are returned unchanged. Other file types fail during processing. Plain path traversal outside the output directory (for example
/../../secret.png) was already rejected and is not affected.Affected versions
astro>= 5.14.3, <= 7.4.6, when used with@astrojs/node(all versions up to 11.1.11). The vulnerable image endpoint is provided byastroand used by the@astrojs/nodeadapter.Patches
Fixed in
astro7.4.7. The path check now compares paths exactly, and only ignores letter case for Windows drive-letter paths. The fix ships inastro, so upgrading@astrojs/nodealone is not enough.Workarounds
Upgrade to
astro7.4.7 or later. Before upgrading, make sure no directory next to the build output directory has a path that differs from it only by letter case.Credits
Reported by @zachariah-mithani.
Severity
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:NReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
Release Notes
withastro/astro (@astrojs/node)
v11.1.12Compare Source
Patch Changes
57137ed]:v11.1.11Compare Source
Patch Changes
7da442b]:v11.1.10Compare Source
Patch Changes
8a92f7cThanks @astro-factory! - Fixes on-demand routes receiving an empty request body on Node.js 26 whenstaticHeadersis enabledConfiguration
📅 Schedule: (UTC)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate CLI.