Skip to main content
cve.nowby Sazabi
← npm
npmPackage

@astrojs/node

9 known vulnerabilities (1 high, 7 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release
11.1.11 (Nov 5, 2026): no advisory affects it
Newest unaffected release
11.1.11 (Nov 5, 2026), the latest release
Advisories
9 · 1 high, 7 medium, 1 low
Weekly downloads
1.3M
Dependents
21
Releases
186 since 0.0.2 (Mar 25, 2022)
Registry
npm
Releases read
Nov 8, 2026

Version timeline

  • CVE-2026-102984
    Affects 0.0.0-adapter-sessions-20250207124921 to 11.1.2 (11.1.3 is outside it)
  • CVE-2026-59730
    Affects 8.1.0 to 11.0.1 (11.0.2 is outside it)
  • CVE-2026-41322
    Affects 0.0.0-adapter-sessions-20250207124921 to 10.0.4 (10.0.5 is outside it)
  • CVE-2026-29772
    Affects 0.0.0-adapter-sessions-20250207124921 to 10.0.0-beta.9 (10.0.0 is outside it)
  • CVE-2026-27829
    Affects 9.0.0 to 9.5.3 (9.5.4 is outside it)
  • CVE-2026-27729
    Affects 9.0.0 to 9.5.3 (9.5.4 is outside it)
  • CVE-2026-25545
    Affects 0.0.0-adapter-sessions-20250207124921 to 9.5.3 (9.5.4 is outside it)
  • CVE-2025-55303
    Affects 0.0.0-adapter-sessions-20250207124921 to 9.1.0 (9.1.1 is outside it)
  • CVE-2025-55207
    Affects 0.0.0-adapter-sessions-20250207124921 to 9.4.0 (9.4.1 is outside it)
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 9

  • Astro: Malformed port in the Host header can crash the Node adapter

    Affected: fixed in 11.1.3.

    Fixed in 11.1.3 (released Aug 18, 2026, 43 days before disclosure).

    The latest release, 11.1.11, is not affected.

    34% of @astrojs/node downloads last week were affected versions (506.1K).

  • @astrojs/node: Backslash-prefixed paths not recognized as internal by trailing-slash redirect

    Affected: from 8.1.0, fixed in 11.0.2.

    Fixed in 11.0.2 (released Jul 2, 2026, 25 days before disclosure).

    The latest release, 11.1.11, is not affected.

    29% of @astrojs/node downloads last week were affected versions (432.7K).

  • CVE-2026-41322Medium 5.3

    @astrojs/node: Cache Poisoning due to incorrect error handling when if-match header is malformed

    Affected: fixed in 10.0.5.

    Fixed in 10.0.5 (released Apr 15, 2026, 9 days before disclosure).

    The latest release, 11.1.11, is not affected.

    21% of @astrojs/node downloads last week were affected versions (307.7K).

  • CVE-2026-29772Medium 5.9

    Astro: Memory exhaustion DoS due to missing request body size limit in Server Islands

    Affected: fixed in 10.0.0.

    Fixed in 10.0.0 (released Mar 10, 2026, 14 days before disclosure).

    The latest release, 11.1.11, is not affected.

    20% of @astrojs/node downloads last week were affected versions (299.2K).

  • CVE-2026-27829Medium 6.5

    Astro is vulnerable to SSRF due to missing allowlist enforcement in remote image inferSize

    Affected: from 9.0.0, fixed in 9.5.4.

    Fixed in 9.5.4 (released Feb 18, 2026, 8 days before disclosure).

    The latest release, 11.1.11, is not affected.

    7.5% of @astrojs/node downloads last week were affected versions (112.3K).

  • CVE-2026-27729Medium 5.9

    Astro has memory exhaustion DoS due to missing request body size limit in Server Actions

    Affected: from 9.0.0, fixed in 9.5.4.

    Fixed in 9.5.4 (released Feb 18, 2026, 6 days before disclosure).

    The latest release, 11.1.11, is not affected.

    7.5% of @astrojs/node downloads last week were affected versions (112.3K).

  • CVE-2026-25545Medium 6.9

    Astro has Full-Read SSRF in error rendering via Host: header injection

    Affected: fixed in 9.5.4.

    Fixed in 9.5.4 (released Feb 18, 2026, 6 days before disclosure).

    The latest release, 11.1.11, is not affected.

    10% of @astrojs/node downloads last week were affected versions (150.6K).

  • CVE-2025-55303Medium 6.9

    Unauthorized third-party images in Astro’s _image endpoint

    Affected: fixed in 9.1.1.

    Fixed in 9.1.1 (released Feb 24, 2025, 176 days before disclosure).

    The latest release, 11.1.11, is not affected.

    2.8% of @astrojs/node downloads last week were affected versions (41.8K).

  • CVE-2025-55207Medium 5.5

    @astrojs/node's trailing slash handling causes open redirect issue

    Affected: fixed in 9.4.1.

    Fixed in 9.4.1 (released Aug 14, 2025, 1 day before disclosure).

    The latest release, 11.1.11, is not affected.

    5.4% of @astrojs/node downloads last week were affected versions (80.3K).