CVE-2026-41321

Katalog CVE

CVSS 2.2 · Low EPSS 0,32%

Kerentanan Server-Side Request Forgery (SSRF). Skor CVSS 3.1 2.2 (Low) menurut github.com.

Deskripsi (NVD)

@astrojs/cloudflare is an SSR adapter for use with Cloudflare Workers targets. Prior to 13.1.10, the fetch() call for remote images in packages/integrations/cloudflare/src/utils/image-binding-transform.ts uses the default redirect: 'follow' behavior. This allows the Cloudflare Worker to follow HTTP redirects to arbitrary URLs, bypassing the isRemoteAllowed() domain allowlist check which only validates the initial URL. This vulnerabiity is caused by an incomplete fix for CVE-2025-58179. This vulnerability is fixed in 13.1.10.

Rincian

Terbit di NVD

24 April 2026

Terakhir diubah

17 Juni 2026

Status NVD

Deferred

CVSS 3.1

2.2 (Low), sumber github.com
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-918: Server-Side Request Forgery (SSRF)

EPSS (30 hari)

0,32% peluang dieksploitasi; lebih tinggi dari 22,9% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/withastro/astro/security/advisories/GHSA-88gm-j2wx-58h6