Detections
Analytics

SCA: security update for @astrojs/node (GHSA-cj9f-h6r6-4cx2)

high Tenable Cloud Security Plugin ID 438008

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Astro is a web framework. In versions 9.0.0 through 9.5.3, a bug in Astro's image pipeline allows
 bypassing `image.domains` / `image.remotePatterns` restrictions, enabling the server to fetch content from
 unauthorized remote hosts. Astro provides an `inferSize` option that fetches remote images at render time
 to determine their dimensions. Remote image fetches are intended to be restricted to domains the site
 developer has manually authorized (using the `image.domains` or `image.remotePatterns` options). However,
 when `inferSize` is used, no domain validation is performed — the image is fetched from any host
 regardless of the configured restrictions. An attacker who can influence the image URL (e.g., via CMS
 content or user-supplied data) can cause the server to fetch from arbitrary hosts. This allows bypassing
 `image.domains` / `image.remotePatterns` restrictions to make server-side requests to unauthorized hosts.
 This includes the risk of server-side request forgery (SSRF) against internal network services and cloud
 metadata endpoints. Version 9.5.4 fixes the issue. (CVE-2026-27829)

See Also

https://github.com/advisories/GHSA-cj9f-h6r6-4cx2

Plugin Details

Severity: High

ID: 438008

Version: Revision 1.7

Type: Local

Family: SCA Checks

Published: 2/28/2026

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 2.3

Percentile: 9.42

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 6.4

Temporal Score: 5

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:P

CVSS Score Source: CVE-2026-27829

CVSS v3

Risk Factor: High

Base Score: 7.2

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 2/25/2026

Vulnerability Publication Date: 2/25/2026

Reference Information

CVE: CVE-2026-27829

cwe: CWE-918