CVE-2026-126364

## Summary The `/_image` endpoint used by the `@astrojs/node` adapter checks that a requested local image is inside the build output directory before reading it from disk. That check compared paths case-insensitively. On case-sensitive filesystems (such as Linux), a directory whose path differs from the output directory only by letter case is a different directory, but it passed the check. For example, with the client output directory at `/srv/app/dist/client/`, a request such as: ```text /_image?href=/../../DIST/client/secret.png&w=32&f=png ``` resolved to `/srv/app/DIST/client/secret.png` and was served, even though that file is outside the output directory. ## Impact An unauthenticated attacker can read image files from outside the output directory, but only when all of the following are true: - The site uses on-demand rendering with the `@astrojs/node` adapter. - The server runs on a case-sensitive filesystem. - A directory exists whose path matches the output directory except for letter case (for example `DIST/client` next to `dist/client`). Such a layout is unusual, and the attacker cannot create it. Only files the image service accepts can be read. Raster images are returned after resizing; SVG files are returned unchanged. Other file types fail during processing. Plain path traversal outside the output directory (for example `/../../secret.png`) was already rejected and is not affected. ## Affected versions `astro` >= 5.14.3, <= 7.4.6, when used with `@astrojs/node` (all versions up to 11.1.11). The vulnerable image endpoint is provided by `astro` and used by the `@astrojs/node` adapter. ## Patches Fixed in `astro` 7.4.7. The path check now compares paths exactly, and only ignores letter case for Windows drive-letter paths. The fix ships in `astro`, so upgrading `@astrojs/node` alone is not enough. ## Workarounds Upgrade to `astro` 7.4.7 or later. Before upgrading, make sure no directory next to the build output directory has a path that differ