---
id: "GHSA-r3h5-4585-7x3w"
page: "https://infrastack.ai/live/GHSA-r3h5-4585-7x3w"
kind: "vulnerability"
aliases: ["GHSA-r3h5-4585-7x3w"]
title: "Image endpoint in @astrojs/node can read files from a case-variant sibling of the output directory on case-sensitive filesystems"
severity: "low"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "@astrojs/node", "fixed": [], "affected": "<= 11.1.11", "ecosystem": "npm"}, {"name": "astro", "fixed": ["7.4.7"], "affected": ">= 5.14.3, <= 7.4.6", "ecosystem": "npm"}]
ecosystems: ["npm"]
tags: ["@astrojs/node", "astro", "cwe-178", "cwe-22", "linux", "package", "self-hosted"]
not_affected_if: ["managed-hosting", "no-case-variant-directory", "static-export"]
published_at: "2026-11-09T12:21:36+00:00"
first_seen_at: "2026-11-09T22:53:16+00:00"
updated_at: "2026-11-09T22:58:31+00:00"
sources: [{"source": "ghsa-repo", "url": "https://github.com/withastro/astro/security/advisories/GHSA-r3h5-4585-7x3w", "first_seen_at": "2026-11-09T22:53:16+00:00"}]
exploit_sources: []
---

# Image endpoint in @astrojs/node can read files from a case-variant sibling of the output directory on case-sensitive filesystems

Link for people: https://infrastack.ai/live/GHSA-r3h5-4585-7x3w (this .md is for agents)

On case-sensitive filesystems, the Astro /_image endpoint's path check compared paths case-insensitively, so a directory differing only by letter case from the build output directory passed the check. An unauthenticated attacker could read image files from outside the output directory, but only when a case-variant directory already exists on the server.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:@astrojs/node affected <= 11.1.11 fixed no fixed version listed
- npm:astro affected >= 5.14.3, <= 7.4.6 fixed 7.4.7

## How to check

- Check the `astro` version in `package.json` and the lockfile; affected range is `>= 5.14.3, <= 7.4.6`.
- Confirm the site uses on-demand rendering with the `@astrojs/node` adapter.
- Check whether the server runs on a case-sensitive filesystem and whether a directory exists next to the build output (e.g. `DIST/client` beside `dist/client`).

## Fix

- `astro` `7.4.7`
- `@astrojs/node` alone is not enough; the fix ships in `astro`.

## Timeline

- 2026-11-09T22:53:16+00:00 ghsa-repo https://github.com/withastro/astro/security/advisories/GHSA-r3h5-4585-7x3w

## Documents

- [advisory] Maintainer's advisory: github.com https://github.com/withastro/astro/security/advisories/GHSA-r3h5-4585-7x3w

## From the sources

## Summary

The `/_image` endpoint used by the `@astrojs/node` adapter checks that a requested local image is inside the build output directory before reading it from disk. That check compared paths case-insensitively. On case-sensitive filesystems (such as Linux), a directory whose path differs from the output directory only by letter case is a different directory, but it passed the check.

For example, with the client output directory at `/srv/app/dist/client/`, a request such as:

```text
/_image?href=/../../DIST/client/secret.png&w=32&f=png
```

resolved to `/srv/app/DIST/client/secret.png` and was served, even though that file is outside the output directory.

## Impact

An unauthenticated attacker can read image files from outside the output directory, but only when all of the following are true:

- The site uses on-demand rendering with the `@astrojs/node` adapter.
- The server runs on a case-sensitive filesystem.
- A directory exists whose path matches the output directory except for letter case (for example `DIST/client` next to `dist/client`). Such a layout is unusual, and the attacker cannot create it.

Only files the image service accepts can be read. Raster images are returned after resizing; SVG files are returned unchanged. Other file types fail during processing. Plain path traversal outside the output directory (for example `/../../secret.png`) was already rejected and is not affected.

## Affected versions

`astro` >= 5.14.3, <= 7.4.6, when used with `@astrojs/node` (all versions up to 11.1.11). The vulnerable image endpoint is provided by `astro` and used by the `@astrojs/node` adapter.

## Patches

Fixed in `astro` 7.4.7. The path check now compares paths exactly, and only ignores letter case for Windows drive-letter paths. The fix ships in `astro`, so upgrading `@astrojs/node` alone is not enough.

## Workarounds

Upgrade to `astro` 7.4.7 or later. Before upgrading, make sure no directory next to the build output directory has a path that differs from it only by letter case.

## Credits

Reported by @zachariah-mithani.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_