Astro @astrojs/node: Denial of service via malformed Host port
Summary
The @astrojs/node adapter of the Astro web framework builds the request URL from the Host header. A malformed port, such as example.com:65536, makes this URL invalid and triggers an uncaught TypeError before routing. In the default standalone setup the request returns HTTP 500 and the server keeps running, but with staticHeaders enabled the Node process terminates. An unauthenticated remote attacker can cause a denial of service; no data exposure or code execution is possible.
Affected
- @astrojs/node up to and including 11.1.2 (per the GitHub advisory; affected < 11.1.3)
Fixed in
- @astrojs/node 11.1.3
- Note: the 11.1.3 release reportedly requires Astro 7.2.1 or later, so the Astro core version may need to be upgraded too. Test before rolling out.
Workaround
- Reverse proxies or CDNs that reject malformed Host headers stop the request before it reaches the Node process. This is a mitigation, not a fix; verify that your proxy enforces it.
- Run the Node server under a process supervisor with automatic restart to limit downtime.
Exploitation
- CISA SSVC: exploitation none, automatable no, technical impact partial.
- No evidence of exploitation in the wild and no public proof of concept found from primary sources.
- CISA KEV status could not be confirmed; re-check before relying on this.
Our recommendation
- Identify all Astro sites using @astrojs/node (check package-lock.json or pnpm-lock.yaml).
- Check Astro core compatibility, then upgrade @astrojs/node to 11.1.3 or later.
- Ensure a proxy or CDN in front of the server rejects malformed Host headers.
- Monitor for unexpected process restarts and HTTP 500 responses.
- Note: the CVSS score differs between sources (CNA 4.0 8.2; GitLab 3.1 7.5); prioritise accordingly.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-qh8j-hqjv-7m4x github.com
- Fix commit 2066f39 github.com
- Pull request #17572 github.com
- Release @astrojs/node 11.1.3 github.com
- OSV GHSA-qh8j-hqjv-7m4x osv.dev
- GitLab advisory CVE-2026-102984 advisories.gitlab.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 17:41.
Original description (NVD)
Astro is a web framework for content-driven websites. Prior to 11.1.3, the @astrojs/node adapter builds a request URL from the Host header, and a malformed port can make that URL invalid. The recovery path reuses the same malformed host and throws an uncaught TypeError: Invalid URL before routing begins. In the default standalone configuration, the request returns an HTTP 500 response and the server continues running, but when staticHeaders is enabled the synchronous handler does not catch the exception and the Node process terminates. Proxies and CDNs that reject malformed Host headers prevent this path from reaching the origin. The issue affects availability only and does not expose data or permit code execution. This issue is fixed in version 11.1.3.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.