Heap-based Buffer Overflow Affecting astro package, versions <7.2.8

astro is an Astro is a modern site builder with web best practices, performance, and DX front-of-mind.

Affected versions of this package are vulnerable to Heap-based Buffer Overflow due to the Sharp image optimization. An attacker can execute code on the server by supplying a malicious AVIF image for Astro to process through its default Sharp-based image service. When Astro optimizes untrusted AVIF content, the underlying libheif dependency used by Sharp can be triggered during image handling, allowing the attacker to compromise the application process that performs the optimization. This can crash or fully take over the server-side image processing workflow, putting the deployment at risk.

• GitHub Commit
• GitHub Commit
• GitHub Commit
• GitHub Release
• Maintainer's Advisory
• Maintainer's Advisory