Description
The fetch() call for remote images in packages/integrations/cloudflare/src/utils/image-binding-transform.ts (line 28) uses the default redirect: 'follow' behavior. This allows the Cloudflare Worker to follow HTTP redirects to arbitrary URLs, bypassing the isRemoteAllowed() domain allowlist check which only validates the initial URL.
Recommendation
Update the @astrojs/cloudflare package to the latest compatible version. Followings are version details:
- Affected version(s): < 13.1.10
- Patched version(s): 13.1.10
References
Could your website be exposed too?
SmartScanner can check your website for Cloudflare has SSRF via redirect following through its image-binding-transform endpoint (incomplete fix for GHSA-qpr4) and gives you actionable findings to investigate.
Start a free scanRelated Issues
- nuxt-og-image SSRF — bypass of GHSA-pqhr-mp3f-hrpp / v6.2.5 fix (IPv6 + redirect) - CVE-2026-44589
- Axios has a Patch Bypass: Proxy-Authorization Header Injection via Prototype Pollution — Incomplete Null-Prototype Fix - CVE-2026-44489
- Server-Side Request Forgery via /_image endpoint in Astro Cloudflare adapter - CVE-2025-58179
- Fedify has an incomplete SSRF mitigation after GHSA-p9cg-vqcc-grcx: validatePublicUrl allows special-use IPv4 ranges - CVE-2026-50131
You might also like:
See something that needs correcting? Let us knowUpdated April 27, 2026