CVE-2026-41321 json
@astrojs/cloudflare: SSRF via redirect following in Cloudflare image-binding-transform endpoint
published 2026-04-23 6 mo ago modified 2026-10-26 13 d ago also GHSA-88gm-j2wx-58h6 , EUVD-2026-25579
- cvss
- 2.2
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 15%
- public exploits
- 0
- none known
Summary
@astrojs/cloudflare is an SSR adapter for use with Cloudflare Workers targets. Prior to 13.1.10, the fetch() call for remote images in packages/integrations/cloudflare/src/utils/image-binding-transform.ts uses the default redirect: 'follow' behavior. This allows the Cloudflare Worker to follow HTTP redirects to arbitrary URLs, bypassing the isRemoteAllowed() domain allowlist check which only validates the initial URL. This vulnerabiity is caused by an incomplete fix for CVE-2025-58179. This vulnerability is fixed in 13.1.10.
Patch / fix
- npm @astrojs/cloudflare 13.1.10
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- partial
- Assessed
- 6 mo ago
Exploit prediction
0.24% chance of exploitation in the next 30 days, higher than 15% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/withastro/astro/security/advisories/GHSA-88gm-j2wx-58h6 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 2.2 | CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L |
| GitHub | 3.1 | 2.2 | CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | @astrojs/cloudflare | <13.1.10 |
13.1.10 |
Affected products
- withastro @astrojs/cloudflare
Classification
- Weakness
-
- CWE-918 Server-Side Request Forgery
References
-
github.com
/withastro/astro/commit/a43eb4b40b4f81530e3c9b5e2959495900320433
web
-
github.com
/withastro/astro/security/advisories/GHSA-88gm-j2wx-58h6
exploit, web
-
nvd.nist.gov
/vuln/detail/CVE-2026-41321
advisory
-
github.com
/advisories/GHSA-qpr4-c339-7vq8
advisory
-
github.com
/withastro/astro
package
-
github.com
/withastro/astro/releases/tag/%40astrojs%2Fcloudflare%4013.1.10
web
Sources
- CVE List CVE-2026-41321
- GitHub Advisory GHSA-88gm-j2wx-58h6
- NVD CVE-2026-41321
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.