Astro: Malformed port in the Host header can crash the Node adapter
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-248.
Summary
Astro is a web framework for content-driven websites. Prior to 11.1.3, the @astrojs/node adapter builds a request URL from the Host header, and a malformed port can make that URL invalid. The recovery path reuses the same malformed host and throws an uncaught TypeError: Invalid URL before routing begins. In the default standalone configuration, the request returns an HTTP 500 response and the server continues running, but when staticHeaders is enabled the synchronous handler does not catch the exception and the Node process terminates. Proxies and CDNs that reject malformed Host headers prevent this path from reaching the origin. The issue affects availability only and does not expose data or permit code execution. This issue is fixed in version 11.1.3.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| withastro | astro | before 11.1.3 | 11.1.3 | Patch available | CNA |
| — | @astrojs/node (npm) | before 11.1.3 | 11.1.3 | Patch available | GHSA-qh8j-hqjv-7m4x |
- astro Vendorwithastro Affected before 11.1.3 Fixed in 11.1.3 Patch available CNA
- @astrojs/node (npm) Vendor— Affected before 11.1.3 Fixed in 11.1.3 Patch available GHSA-qh8j-hqjv-7m4x
Remediation
- Fix · CNA astro (withastro) Fixed in 11.1.3
- Fix · GHSA-qh8j-hqjv-7m4x @astrojs/node (npm) Fixed in 11.1.3 Advisory →
Vendor assessments
Timeline
- 2026-10-02 Threatist record created from CVE-2026-102984
- 2026-10-03 Alias added: GHSA-qh8j-hqjv-7m4x
- 2026-11-06 Affected versions changed · Red Hat
- 2026-11-06 CVSS score added · Red Hat
References
Other 5
- https://github.com/withastro/astro/security/advisories/GHSA-qh8j-hqjv-7m4x
- https://github.com/withastro/astro/pull/17572
- https://github.com/withastro/astro/commit/2066f39c60707a100531b4ef4bb5dab8feafa7f2
- https://github.com/withastro/astro/releases/tag/@astrojs/[email protected]
- https://github.com/withastro/astro
More withastro vulnerabilities
- TI-2026-26147 Astro: Unauthenticated Path Override via `x-astro-path` / `x_astro_path` CVSS 3.1CRITICAL 9.1
- TI-2026-42600 Astro 6.4.7 Authorization Bypass via Decode Iteration Limit and Rewrite Path Canonicalization Mismatch CVSS 3.1HIGH 8.2
- TI-2024-37142 Server source code is exposed to the public if sourcemaps are enabled CVSS 4.0HIGH 7.8
- TI-2025-35987 Astro Cloudflare adapter is vulnerable to Server-Side Request Forgery via /_image endpoint CVSS 3.1HIGH 7.2
- TI-2025-34958 Unauthorized third-party images in Astro’s _image endpoint CVSS 4.0MEDIUM 6.9
- TI-2026-51542 Astro: Unauthenticated path override in the @astrojs/vercel ISR function CVSS 3.1MEDIUM 6.5
Sources
- CVE-2026-102984 · CVE Program
- CVE-2026-102984 · NVD
- FIRST EPSS
- GHSA-qh8j-hqjv-7m4x · GitHub Advisory Database · CC BY 4.0
- CVE-2026-102984 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences