@astrojs/cloudflare
14.4.1 · 19 Oct 2026MIT853.9k / weekRepositoryHomepagenpmAtom feed
Security advisories
From OSV, open ones first. Each release line gets its own fix: an older major is fixed by a patch on that major, not by moving to the newest one.
Is your project affected?
Paste your package.json, or type the range you declare for @astrojs/cloudflare. It is read in your browser and sent nowhere.
| Line | Newest | Where it stands |
|---|---|---|
| 14.4.1 | No known advisory | |
| 13.7.0 | Safe from 13.1.10 | |
| 12.6.13 | 1 open advisory, worst low | |
| 11.2.0 | 16 open advisories, worst high · last release Oct 2024, no longer updated |
- HighServer-Side Request Forgery via /_image endpoint in Astro Cloudflare adapterGHSA-qpr4-c339-7vq8 · 4 Sep 2025
- 12.x12.0.0 – 12.6.5Fixed in 12.6.6
- 11.x11.0.3 – 11.2.0No fix on 11.x · move to 12.6.6
- LowCloudflare has SSRF via redirect following through its image-binding-transform endpoint (incomplete fix for GHSA-qpr4)GHSA-88gm-j2wx-58h6 · 23 Apr 2026
- 13.x13.0.0 – 13.1.9Fixed in 13.1.10
- 12.x12.0.0 – 12.6.13No fix on 12.x · move to 13.1.10
- 11.x and older0.2.0 – 11.2.0No fix, no longer updated · move to 13.1.10
Registry facts last checked 21 Oct 2026. Releases and advisories last read 21 Oct 2026.