@ASTROJS/NODE · GHSA-r3h5-4585-7x3w · Package
FIX → 7.4.7
On case-sensitive filesystems, the Astro /_image endpoint's path check compared paths case-insensitively, so a directory differing only by letter case from the build output directory passed the check. An unauthenticated attacker could read image files from outside the output directory, but only when a case-variant directory already exists on the server.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Sites built with Astro that use on-demand rendering with the @astrojs/node adapter on a case-sensitive filesystem such as Linux. Exposure also requires a directory whose path differs from the output directory only by letter case, which the advisory calls unusual and which the attacker cannot create. Static-only builds and sites not using the node adapter are not affected by the image endpoint path.
Not affected if managed-hosting, no-case-variant-directory, static-export
Who cares @astrojs/node, astro, linux, self-hosted
astro version in package.json and the lockfile; affected range is >= 5.14.3, <= 7.4.6.@astrojs/node adapter.DIST/client beside ).The /_image endpoint used by the @astrojs/node adapter checks that a requested local image is inside the build output directory before reading it from disk. That check compared paths case-insensitively. On case-sensitive filesystems (such as Linux), a directory whose path differs from the output directory only by letter case is a different directory, but it passed the check.
For example, with the client output directory at /srv/app/dist/client/, a request such as:
/_image?href=/../../DIST/client/secret.png&w=32&f=png
resolved to /srv/app/DIST/client/secret.png and was served, even though that file is outside the output directory.
An unauthenticated attacker can read image files from outside the output directory, but only when all of the following are true:
@astrojs/node adapter.DIST/client next to ). Such a layout is unusual, and the attacker cannot create it.Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
dist/clientUpgrade to 7.4.7
astro 7.4.7@astrojs/node alone is not enough; the fix ships in astro.dist/clientOnly files the image service accepts can be read. Raster images are returned after resizing; SVG files are returned unchanged. Other file types fail during processing. Plain path traversal outside the output directory (for example /../../secret.png) was already rejected and is not affected.
astro >= 5.14.3, <= 7.4.6, when used with @astrojs/node (all versions up to 11.1.11). The vulnerable image endpoint is provided by astro and used by the @astrojs/node adapter.
Fixed in astro 7.4.7. The path check now compares paths exactly, and only ignores letter case for Windows drive-letter paths. The fix ships in astro, so upgrading @astrojs/node alone is not enough.
Upgrade to astro 7.4.7 or later. Before upgrading, make sure no directory next to the build output directory has a path that differs from it only by letter case.
Reported by @zachariah-mithani.