Attempted directory traversal doesn't seem to be handled properly #17920

Astro Info

Astro                    v7.3.1
Vite                     v8.2.2
Node                     v24.12.0
System                   Linux (x64)
Package Manager          npm
Output                   server
Adapter                  @astrojs/node (v11.1.5)
Integrations             @astrojs/mdx (v7.0.8)

If this issue only occurs in one browser, which browser is a problem?

No response

Describe the Bug

Requests like this /_image?href=/../../../.env
are resulting in HTTP 500 errors. I'm seeing this on my production server.

On a development build I also see this error
[ERROR] [vite] The request id "/home/dave/my-site/.env" is outside of Vite serving allow list.

so on the Vite dev server as least, the attempted directory traversal almost works.

Reproducible in the Stackblitz Astro empty project.

What's the expected result?

Request is validated and rejected with HTTP 400

Link to Minimal Reproducible Example

https://stackblitz.com/edit/github-d4ey1s3b?file=src%2Fpages%2Findex.astro

Participation

• I am willing to submit a pull request for this issue.