# @astrojs/node (npm) vulnerabilities 9 known vulnerabilities (1 high, 7 medium, 1 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 11.1.11 (Nov 5, 2026): no advisory affects it - Newest unaffected release: 11.1.11 (Nov 5, 2026), the latest release - Weekly downloads: 1.3M - Dependents: 21 - Releases: 186 since 0.0.2 (Mar 25, 2022) - Registry: https://www.npmjs.com/package/@astrojs/node - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-102984: 0.0.0-adapter-sessions-20250207124921 to 11.1.2 (11.1.3 is outside it) - CVE-2026-59730: 8.1.0 to 11.0.1 (11.0.2 is outside it) - CVE-2026-41322: 0.0.0-adapter-sessions-20250207124921 to 10.0.4 (10.0.5 is outside it) - CVE-2026-29772: 0.0.0-adapter-sessions-20250207124921 to 10.0.0-beta.9 (10.0.0 is outside it) - CVE-2026-27829: 9.0.0 to 9.5.3 (9.5.4 is outside it) - CVE-2026-27729: 9.0.0 to 9.5.3 (9.5.4 is outside it) - CVE-2026-25545: 0.0.0-adapter-sessions-20250207124921 to 9.5.3 (9.5.4 is outside it) - CVE-2025-55303: 0.0.0-adapter-sessions-20250207124921 to 9.1.0 (9.1.1 is outside it) - CVE-2025-55207: 0.0.0-adapter-sessions-20250207124921 to 9.4.0 (9.4.1 is outside it) ## Advisories (9) ### [CVE-2026-102984](https://cve.now/CVE-2026-102984): Astro: Malformed port in the Host header can crash the Node adapter - Severity: High 8.2 - Published: Sep 30, 2026 - Affected: fixed in 11.1.3. - Fixed in 11.1.3 (released Aug 18, 2026, 43 days before disclosure). - The latest release, 11.1.11, is not affected. - 34% of @astrojs/node downloads last week were affected versions (506.1K). ### [CVE-2026-59730](https://cve.now/CVE-2026-59730): @astrojs/node: Backslash-prefixed paths not recognized as internal by trailing-slash redirect - Severity: Low 2.1 - Published: Jul 27, 2026 - Affected: from 8.1.0, fixed in 11.0.2. - Fixed in 11.0.2 (released Jul 2, 2026, 25 days before disclosure). - The latest release, 11.1.11, is not affected. - 29% of @astrojs/node downloads last week were affected versions (432.7K). ### [CVE-2026-41322](https://cve.now/CVE-2026-41322): @astrojs/node: Cache Poisoning due to incorrect error handling when if-match header is malformed - Severity: Medium 5.3 - Published: Apr 24, 2026 - Affected: fixed in 10.0.5. - Fixed in 10.0.5 (released Apr 15, 2026, 9 days before disclosure). - The latest release, 11.1.11, is not affected. - 21% of @astrojs/node downloads last week were affected versions (307.7K). ### [CVE-2026-29772](https://cve.now/CVE-2026-29772): Astro: Memory exhaustion DoS due to missing request body size limit in Server Islands - Severity: Medium 5.9 - Published: Mar 24, 2026 - Affected: fixed in 10.0.0. - Fixed in 10.0.0 (released Mar 10, 2026, 14 days before disclosure). - The latest release, 11.1.11, is not affected. - 20% of @astrojs/node downloads last week were affected versions (299.2K). ### [CVE-2026-27829](https://cve.now/CVE-2026-27829): Astro is vulnerable to SSRF due to missing allowlist enforcement in remote image inferSize - Severity: Medium 6.5 - Published: Feb 26, 2026 - Affected: from 9.0.0, fixed in 9.5.4. - Fixed in 9.5.4 (released Feb 18, 2026, 8 days before disclosure). - The latest release, 11.1.11, is not affected. - 7.5% of @astrojs/node downloads last week were affected versions (112.3K). ### [CVE-2026-27729](https://cve.now/CVE-2026-27729): Astro has memory exhaustion DoS due to missing request body size limit in Server Actions - Severity: Medium 5.9 - Published: Feb 24, 2026 - Affected: from 9.0.0, fixed in 9.5.4. - Fixed in 9.5.4 (released Feb 18, 2026, 6 days before disclosure). - The latest release, 11.1.11, is not affected. - 7.5% of @astrojs/node downloads last week were affected versions (112.3K). ### [CVE-2026-25545](https://cve.now/CVE-2026-25545): Astro has Full-Read SSRF in error rendering via Host: header injection - Severity: Medium 6.9 - Published: Feb 24, 2026 - Affected: fixed in 9.5.4. - Fixed in 9.5.4 (released Feb 18, 2026, 6 days before disclosure). - The latest release, 11.1.11, is not affected. - 10% of @astrojs/node downloads last week were affected versions (150.6K). ### [CVE-2025-55303](https://cve.now/CVE-2025-55303): Unauthorized third-party images in Astro’s \_image endpoint - Severity: Medium 6.9 - Published: Aug 19, 2025 - Affected: fixed in 9.1.1. - Fixed in 9.1.1 (released Feb 24, 2025, 176 days before disclosure). - The latest release, 11.1.11, is not affected. - 2.8% of @astrojs/node downloads last week were affected versions (41.8K). ### [CVE-2025-55207](https://cve.now/CVE-2025-55207): @astrojs/node's trailing slash handling causes open redirect issue - Severity: Medium 5.5 - Published: Aug 15, 2025 - Affected: fixed in 9.4.1. - Fixed in 9.4.1 (released Aug 14, 2025, 1 day before disclosure). - The latest release, 11.1.11, is not affected. - 5.4% of @astrojs/node downloads last week were affected versions (80.3K). --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/npm/@astrojs/node Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.