CVE-2026-102984
Received Received - Intake

Astro Framework Host Header Port Parsing Flaw Leads to DoS

Publication date: 2026-09-30

Last updated on: 2026-09-30

Assigner: GitHub, Inc.

Description
Astro is a web framework for content-driven websites. Prior to 11.1.3, the @astrojs/node adapter builds a request URL from the Host header, and a malformed port can make that URL invalid. The recovery path reuses the same malformed host and throws an uncaught TypeError: Invalid URL before routing begins. In the default standalone configuration, the request returns an HTTP 500 response and the server continues running, but when staticHeaders is enabled the synchronous handler does not catch the exception and the Node process terminates. Proxies and CDNs that reject malformed Host headers prevent this path from reaching the origin. The issue affects availability only and does not expose data or permit code execution. This issue is fixed in version 11.1.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-30
Last Modified
2026-09-30
Generated
2026-09-30
AI Q&A
2026-09-30
EPSS Evaluated
N/A
NVD
CVE-2026-102984
EUVD
EUVD-2026-89970

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
astro astro 11.1.3
astro astrojs_node 11.1.3
astro astrojs_node to 11.1.3 (exc)
astrojs node 11.1.3

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-248 An exception is thrown from a function, but it is not caught.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the Astro Node adapter (versions 11.1.2 and earlier). A malformed port in the Host header, such as example.com:65536 or example.com:8080:8080, causes an invalid URL to be generated. The system attempts to recover by reusing the same malformed host, leading to an uncaught TypeError: Invalid URL during request processing before any route executes.

Detection Guidance

To detect this vulnerability, monitor for HTTP 500 errors or Node process crashes when malformed Host headers are sent. Test with curl commands like: curl -H 'Host: example.com:65536' http://yourserver.com or curl -H 'Host: example.com:8080:8080' http://yourserver.com. Check server logs for uncaught TypeError: Invalid URL exceptions.

Impact Analysis

The impact varies by configuration. In default standalone mode, the server returns a 500 error but remains operational. If staticHeaders is enabled, the error becomes an uncaught exception, terminating the Node process. This only affects availability, not data exposure or code execution.

Compliance Impact

This vulnerability primarily impacts availability by causing server crashes under specific conditions, but it does not expose data or permit code execution. Compliance with standards like GDPR or HIPAA is not directly affected since no data breaches or unauthorized access occur. However, prolonged downtime due to crashes could indirectly impact compliance with availability requirements in these standards.

Mitigation Strategies

Upgrade @astrojs/node to version 11.1.3 or later. If using staticHeaders: true, disable it temporarily until upgrade. Configure reverse proxies or CDNs to block malformed Host headers. Monitor for crashes and review Host header handling in logs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-102984. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart