@astrojs/cloudflare is an SSR adapter targeting Cloudflare Workers. In versions before 13.1.10, the fetch() call for remote images uses the default redirect behavior ('follow'), which allows HTTP redirects to arbitrary URLs. The domain allowlist check (isRemoteAllowed()) only validates the initial URL and does not account for redirects, enabling SSRF. This vulnerability is a result of an incomplete fix for CVE-2025-58179. The issue is fixed in version 13.1.10. The CVSS v3.1 base score is 2.2, indicating low severity, with network attack vector, high attack complexity, requiring privileges, no user interaction, unchanged scope, and low availability impact.

The vulnerability allows an attacker with privileges to cause the Cloudflare Worker to follow HTTP redirects to arbitrary URLs, bypassing domain allowlist checks. This can lead to limited availability impact but does not affect confidentiality or integrity. There are no known exploits in the wild. The low CVSS score reflects the limited impact and the requirement for privileges to exploit.

A patch is available in version 13.1.10 of @astrojs/cloudflare that fixes this SSRF vulnerability by addressing the redirect behavior in fetch() calls. Since this is a cloud service adapter, the vendor manages remediation for the cloud-hosted service. Users should upgrade to version 13.1.10 or later to mitigate this vulnerability. Check the vendor advisory for the latest remediation guidance.