CVE-2026-29772

Astro is a web framework. Prior to version 10.0.0, Astro's Server Islands POST handler buffers and parses the full request body as JSON without enforcing a size limit. Because JSON.parse() allocates a V8 heap object for every element in the input, a crafted payload of many small JSON objects achieves ~15x memory amplification (wire bytes to heap bytes), allowing a single unauthenticated request to exhaust the process heap and crash the server. The /_server-islands/[name] route is registered on all Astro SSR apps regardless of whether any component uses server:defer, and the body is parsed before the island name is validated, so any Astro SSR app with the Node standalone adapter is affected. This issue has been patched in version 10.0.0.

CVSS v3 5.9 MEDIUM

5.9^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/withastro/astro/security/advisories/GHSA-3rmj-9m5h-8fpv	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:astro:\@astrojs\/node:*:*:*:*:*:node.js:*:*

History

No history.

Information

Published : 2026-03-24 19:16

Updated : 2026-03-25 21:48

NVD link : CVE-2026-29772

Mitre link : CVE-2026-29772

CVE.ORG link : CVE-2026-29772

JSON object : View

Products Affected

astro

\@astrojs\/node

CWE

CWE-770

Allocation of Resources Without Limits or Throttling

{"id": "CVE-2026-29772", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.2}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2026-03-24T19:16:51.153", "references": [{"url": "https://github.com/withastro/astro/security/advisories/GHSA-3rmj-9m5h-8fpv", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-770"}]}], "descriptions": [{"lang": "en", "value": "Astro is a web framework. Prior to version 10.0.0, Astro's Server Islands POST handler buffers and parses the full request body as JSON without enforcing a size limit. Because JSON.parse() allocates a V8 heap object for every element in the input, a crafted payload of many small JSON objects achieves ~15x memory amplification (wire bytes to heap bytes), allowing a single unauthenticated request to exhaust the process heap and crash the server. The /_server-islands/[name] route is registered on all Astro SSR apps regardless of whether any component uses server:defer, and the body is parsed before the island name is validated, so any Astro SSR app with the Node standalone adapter is affected. This issue has been patched in version 10.0.0."}, {"lang": "es", "value": "Astro es un framework web. Antes de la versi\u00f3n 10.0.0, el gestor POST de Server Islands de Astro almacena en b\u00fafer y analiza el cuerpo completo de la solicitud como JSON sin aplicar un l\u00edmite de tama\u00f1o. Debido a que JSON.parse() asigna un objeto de pila V8 para cada elemento en la entrada, una carga \u00fatil manipulada de muchos objetos JSON peque\u00f1os logra una amplificaci\u00f3n de memoria de ~15x (bytes en tr\u00e1nsito a bytes en pila), permitiendo que una \u00fanica solicitud no autenticada agote la pila del proceso y bloquee el servidor. La ruta /_server-islands/[name] est\u00e1 registrada en todas las aplicaciones Astro SSR independientemente de si alg\u00fan componente utiliza server:defer, y el cuerpo se analiza antes de que se valide el nombre de la isla, por lo que cualquier aplicaci\u00f3n Astro SSR con el adaptador aut\u00f3nomo de Node se ve afectada. Este problema ha sido parcheado en la versi\u00f3n 10.0.0."}], "lastModified": "2026-03-25T21:48:16.560", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:astro:\\@astrojs\\/node:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "315766F8-1240-4160-98C4-652A21AF6CED", "versionEndExcluding": "10.0.0", "versionStartIncluding": "9.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}