medium6.3
CVE-2026-126364Some package fixes recorded
Astro: Image endpoint in @astrojs/node can read files from a case-variant sibling of the output directory on case-sensitive filesystems
The /_image endpoint used by the @astrojs/node adapter checks that a requested local image is inside the build output directory before reading it from disk. That check compared paths case-insensitively. On case-sensitive filesystems (such as Linux), a directory whose path differs from the output directory only by letter case is a different directory, but it passed the check.
Recorded fixes — astro: 7.4.7. Check your release branch.
Exploitation not established
@astrojs/node npm
| Affected range | Recorded fix |
|---|---|
| Earlier releases through 11.1.11 (inclusive)Semantic versions | Not recorded |
Version evidence: OSV · GHSA-r3h5-4585-7x3w
View original version evidence
{
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "11.1.11"
}
],
"type": "SEMVER"
}
],
"versions": []
}