{"id":"CVE-2026-126364","aliases":["GHSA-r3h5-4585-7x3w"],"title":"Astro: Image endpoint in @astrojs/node can read files from a case-variant sibling of the output directory on case-sensitive filesystems","titleSource":"GitHub_M","descriptionSource":"OSV","declaredSeverity":"MODERATE","description":"## Summary\n\nThe `/_image` endpoint used by the `@astrojs/node` adapter checks that a requested local image is inside the build output directory before reading it from disk. That check compared paths case-insensitively. On case-sensitive filesystems (such as Linux), a directory whose path differs from the output directory only by letter case is a different directory, but it passed the check.\n\nFor example, with the client output directory at `/srv/app/dist/client/`, a request such as:\n\n```text\n/_image?href=/../../DIST/client/secret.png&w=32&f=png\n```\n\nresolved to `/srv/app/DIST/client/secret.png` and was served, even though that file is outside the output directory.\n\n## Impact\n\nAn unauthenticated attacker can read image files from outside the output directory, but only when all of the following are true:\n\n- The site uses on-demand rendering with the `@astrojs/node` adapter.\n- The server runs on a case-sensitive filesystem.\n- A directory exists whose path matches the output directory except for letter case (for example `DIST/client` next to `dist/client`). Such a layout is unusual, and the attacker cannot create it.\n\nOnly files the image service accepts can be read. Raster images are returned after resizing; SVG files are returned unchanged. Other file types fail during processing. Plain path traversal outside the output directory (for example `/../../secret.png`) was already rejected and is not affected.\n\n## Affected versions\n\n`astro` >= 5.14.3, <= 7.4.6, when used with `@astrojs/node` (all versions up to 11.1.11). The vulnerable image endpoint is provided by `astro` and used by the `@astrojs/node` adapter.\n\n## Patches\n\nFixed in `astro` 7.4.7. The path check now compares paths exactly, and only ignores letter case for Windows drive-letter paths. The fix ships in `astro`, so upgrading `@astrojs/node` alone is not enough.\n\n## Workarounds\n\nUpgrade to `astro` 7.4.7 or later. Before upgrading, make sure no directory next to the build output directory has a path that differs from it only by letter case.\n\n## Credits\n\nReported by @zachariah-mithani.","severity":"medium","score":6.3,"published":"2026-11-12T22:33:17.635Z","modified":"2026-11-13T18:45:07.651Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"npm","name":"@astrojs/node","sources":[{"name":"OSV · GHSA-r3h5-4585-7x3w","url":"https://osv.dev/vulnerability/GHSA-r3h5-4585-7x3w"}],"ranges":[{"events":[{"introduced":"0"},{"last_affected":"11.1.11"}],"type":"SEMVER"}],"versions":[],"fixed":[]},{"ecosystem":"npm","name":"astro","sources":[{"name":"OSV · GHSA-r3h5-4585-7x3w","url":"https://osv.dev/vulnerability/GHSA-r3h5-4585-7x3w"}],"ranges":[{"events":[{"introduced":"5.14.3"},{"fixed":"7.4.7"}],"type":"SEMVER"}],"versions":[],"fixed":["7.4.7"]}],"sourceAffected":[],"references":["https://github.com/withastro/astro/security/advisories/GHSA-r3h5-4585-7x3w","https://github.com/withastro/astro/commit/7da442bb286e0c29e1c9e1add6727b7cbf434f1a","https://github.com/withastro/astro/releases/tag/astro@7.4.7","https://nvd.nist.gov/vuln/detail/CVE-2026-126364","https://github.com/withastro/astro"],"sources":[{"name":"CVE","id":"CVE-2026-126364","modified":"2026-11-13T00:37:58.791Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-126364"},{"name":"OSV","id":"GHSA-r3h5-4585-7x3w","modified":"2026-11-13T18:45:07.651099305Z","url":"https://osv.dev/vulnerability/GHSA-r3h5-4585-7x3w"}],"assessments":[{"source":"GitHub_M","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","score":6.3},{"source":"OSV","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","score":6.3}],"cve":{"records":[{"id":"CVE-2026-126364","source":"GitHub_M","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-11-10T21:12:01.228Z","published":"2026-11-12T22:33:17.635Z","modified":"2026-11-13T00:37:58.791Z"}],"publishers":[{"name":"GitHub_M","role":"CNA","organizationId":"a0819718-46f1-4df5-94e2-005712e83aaa","modified":"2026-11-12T22:33:17.635Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-13T00:37:58.791Z"}],"references":[{"url":"https://github.com/withastro/astro/security/advisories/GHSA-r3h5-4585-7x3w","tags":["x_refsource_CONFIRM"],"source":"GitHub_M"},{"url":"https://github.com/withastro/astro/commit/7da442bb286e0c29e1c9e1add6727b7cbf434f1a","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/withastro/astro/releases/tag/astro@7.4.7","tags":["x_refsource_MISC"],"source":"GitHub_M"}],"weaknesses":[{"id":"CWE-22","description":"CWE-22: Improper Limitation of a Pathname to a Restricted Directory","source":"GitHub_M"},{"id":"CWE-178","description":"CWE-178: Improper Handling of Case Sensitivity","source":"GitHub_M"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-11-13T00:37:48.200390Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"products":[{"vendor":"withastro","name":"astro","platforms":[],"versions":[{"version":">= 5.14.3, < 7.4.7","status":"affected"}],"cpes":[],"source":"GitHub_M","url":"https://www.cve.org/CVERecord?id=CVE-2026-126364"}],"remediation":[],"observedAt":"2026-11-13T19:22:40.348Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T03:00:33.317Z"},"coverage":[{"source":"NVD","status":"no-result","checkedAt":"2026-11-12T23:35:32.519Z","attemptedAt":"2026-11-12T23:35:32.519Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-11-12T23:35:32.614Z","attemptedAt":"2026-11-12T23:35:32.614Z"},{"source":"EUVD","status":"available","checkedAt":"2026-11-12T23:35:32.188Z","attemptedAt":"2026-11-12T23:35:32.188Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-11-12T23:35:32.026Z","attemptedAt":"2026-11-12T23:35:32.026Z"}],"evidence":[{"source":"ENISA EUVD","id":"EUVD-2026-124748","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-124748","modified":"Nov 12, 2026, 10:33:17 PM","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","checkedAt":"2026-11-12T23:35:32.188Z"}],"aiSummary":{"text":"Astro versions 5.14.3 to 7.4.6 are vulnerable when used with @astrojs/node on case-sensitive filesystems, allowing unauthenticated attackers to read image files from outside the output directory if a case-variant sibling directory exists. The image endpoint checks paths case-insensitively. Only image files can be read.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-13T19:26:05.206Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-126364"},{"name":"OSV","url":"https://osv.dev/vulnerability/GHSA-r3h5-4585-7x3w"}]}}