{"id":"CVE-2026-41321","aliases":["GHSA-88gm-j2wx-58h6"],"url":"https://o3.security/vulnerability/CVE-2026-41321","summary":"@astrojs/cloudflare: SSRF via redirect following in Cloudflare image-binding-transform endpoint","details":"## Summary\n\nThe `fetch()` call for remote images in `packages/integrations/cloudflare/src/utils/image-binding-transform.ts` (line 28) uses the default `redirect: 'follow'` behavior. This allows the Cloudflare Worker to follow HTTP redirects to arbitrary URLs, bypassing the `isRemoteAllowed()` domain allowlist check which only validates the initial URL.\n\nAll three other image fetch paths in the codebase correctly use `{ redirect: 'manual' }`. This is an incomplete fix for GHSA-qpr4-c339-7vq8.\n\nConfirmed on HEAD.\n\n## Root Cause\n\n`image-binding-transform.ts` line 28:\n\n    const content = await (isRemotePath(href) ? fetch(imageSrc) : assets.fetch(imageSrc));\n\nMissing `{ redirect: 'manual' }`. The three protected paths:\n\n    // image-passthrough-endpoint.ts:23\n    response = await fetch(href, { redirect: 'manual' });\n\n    // assets/endpoint/shared.ts:11\n    const res = await fetch(src, { redirect: 'manual' });\n\n    // assets/utils/remoteProbe.ts:53\n    const response = await fetch(url, { redirect: 'manual' });\n\n## PoC\n\nDemonstrated with Node.js that `fetch()` without `redirect: 'manual'` follows 302 redirects to arbitrary destinations:\n\n    # Server A (allowed domain) returns 302 → Server B (internal)\n    fetch('http://allowed:19741/img.jpg')                        → follows 302 → hits http://internal:19742/secret\n    fetch('http://allowed:19741/img.jpg', {redirect:'manual'})   → returns 302, internal server NOT hit\n\nAttack path: attacker finds an open redirect on an allowed domain, crafts `/_image?href=https://allowed-cdn.com/redirect?url=http://internal-service/`, and the Worker follows the redirect to the unauthorized destination.\n\n## Impact\n\nBypasses the `image.domains` and `image.remotePatterns` allowlist for the default Cloudflare image service (`cloudflare-binding`). Enables blind SSRF to domains not in the allowlist. Same vulnerability class as GHSA-qpr4-c339-7vq8 (HIGH) which fixed the passthrough endpoint but missed this one.\n\n## Suggested Fix\n\n    const content = await (isRemotePath(href) ? fetch(imageSrc, { redirect: 'manual' }) : assets.fetch(imageSrc));","published":"2026-04-24T17:04:06.118Z","modified":"2026-08-12T03:51:13.377835451Z","cvss":{"score":2.2,"severity":"LOW","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L"},"epss":{"score":0.00199,"percentile":0.09944,"asOf":"2026-09-16"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"@astrojs/cloudflare","fixedVersion":"13.1.10"}],"fix":{"url":"https://github.com/withastro/astro/commit/a43eb4b40b4f81530e3c9b5e2959495900320433","label":"withastro/astro@a43eb4b"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41321.json"},{"type":"ADVISORY","url":"https://github.com/withastro/astro/security/advisories/GHSA-88gm-j2wx-58h6"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41321"},{"type":"WEB","url":"https://github.com/withastro/astro/commit/a43eb4b40b4f81530e3c9b5e2959495900320433"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-qpr4-c339-7vq8"},{"type":"PACKAGE","url":"https://github.com/withastro/astro"},{"type":"WEB","url":"https://github.com/withastro/astro/releases/tag/%40astrojs%2Fcloudflare%4013.1.10"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:13.377835451Z"}}