CVE-2026-102984
Description
A flaw was found in @astrojs/node. A remote attacker can cause a Denial of Service (DoS) by sending a specially crafted HTTP request containing a malformed port in the Host header. When static header handling is enabled, the adapter fails to catch the resulting URL parsing error, causing the Node process to crash and terminate service.
Statement
A flaw of IMPORTANT severity was found in the upstream @astrojs/node npm package, the Node.js adapter for the Astro web framework. A remote, unauthenticated attacker can cause a denial of service by sending an HTTP request with a malformed port in the Host header: the adapter constructs an invalid request URL and throws an uncaught TypeError before routing begins. In the default standalone configuration the request only produces an HTTP 500 response and the server keeps running, but when the staticHeaders option is enabled the synchronous handler does not catch the exception and the Node process terminates, interrupting service. The impact is limited to availability; the flaw does not expose data or permit code execution. No Red Hat products are currently listed as affected by this flaw. Red Hat scores this flaw 7.5 (CVSS:3.1, Important) while the upstream CVEORG record scores 8.2 (CVSS:4.0, Important); the score difference reflects upstream's higher attack-complexity assessment, but both map to an Important severity rating.
Mitigation
Workarounds are available for this issue. The process crash occurs only when the staticHeaders option is enabled; in the default standalone configuration a request with a malformed Host header only produces an HTTP 500 response and the server continues running, so disabling the staticHeaders option prevents the process termination. Deploying a reverse proxy or CDN in front of the Node.js origin that rejects requests with malformed Host headers also prevents such requests from reaching the vulnerable adapter. The upstream project has fixed this issue in @astrojs/node 11.1.3, so updating the @astrojs/node package to 11.1.3 or later resolves the issue.
Understanding the Weakness (CWE)
Availability,Confidentiality
Technical Impact: DoS: Crash, Exit, or Restart; Read Application Data
An uncaught exception could cause the system to be placed in a state that could lead to a crash, exposure of sensitive information, or other unintended behaviors.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
