CVE-2026-126364

The /_image endpoint used by the @astrojs/node adapter checks that a requested local image is inside the build output directory before reading it from disk. That check compared paths case-insensitively. On case-sensitive filesystems (such as Linux), a directory whose path differs from the output directory only by letter case is a different directory, but it passed the check.

For example, with the client output directory at /srv/app/dist/client/, a request such as:

resolved to /srv/app/DIST/client/secret.png and was served, even though that file is outside the output directory.

An unauthenticated attacker can read image files from outside the output directory, but only when all of the following are true:

• The site uses on-demand rendering with the @astrojs/node adapter.
• The server runs on a case-sensitive filesystem.
• A directory exists whose path matches the output directory except for letter case (for example DIST/client next to dist/client).