Log in Start free

Vulnerability · Published Sep 30, 2026 · Assigned by GitHub_M

CVE-2026-102984Astro: Malformed port in the Host header can crash the Node adapter

High 8.2

In plain English

A high-severity security flaw in astro from withastro. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)8.2High
Exploit odds (30 days)0.4%top 69.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Astro is a web framework for content-driven websites. Prior to 11.1.3, the @astrojs/node adapter builds a request URL from the Host header, and a malformed port can make that URL invalid. The recovery path reuses the same malformed host and throws an uncaught TypeError: Invalid URL before routing begins. In the default standalone configuration, the request returns an HTTP 500 response and the server continues running, but when staticHeaders is enabled the synchronous handler does not catch the exception and the Node process terminates. Proxies and CDNs that reject malformed Host headers prevent this path from reaching the origin. The issue affects availability only and does not expose data or permit code execution. This issue is fixed in version 11.1.3.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
npm@astrojs/node11.1.3GHSA-qh8j-hqjv-7m4x

Affected products (as reported)

VendorProductVersions
withastro astro < 11.1.3

Weakness: CWE-248 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References