Packages / @astrojs/node / Security

HighVulnerabilityGHSA-qh8j-hqjv-7m4xCVE-2026-102984Published 30 Sep 2026

Astro: Malformed port in the Host header can crash the Node adapter

Affected releases · @astrojs/node

  • 11.x11.0.0 – 11.1.2Fixed in 11.1.3
  • 10.x10.0.0 – 10.1.4No fix on this line yet
  • 9.x9.0.0 – 9.5.5No fix on this line yet
  • 8.x and older0.0.2 – 8.3.4No fix, no longer updated

On 11.x, the newest line:

npm install @astrojs/node@11.1.3
11.x

  1. Affected

    11.0.0 – 11.1.2

    7 releases

  2. Fixed

    11.1.3 – 11.1.9

    7 releases, latest

10.x

  1. Affected

    10.0.0 – 10.1.4

    12 releases

9.x

  1. Affected

    9.0.0 – 9.5.5

    28 releases

8.x

  1. Affected

    8.0.0 – 8.3.4

    14 releases

7.x

  1. Affected

    7.0.0 – 7.0.4

    5 releases

6.x

  1. Affected

    6.0.0 – 6.1.0

    6 releases

5.x

  1. Affected

    5.0.0 – 5.3.6

    18 releases

4.x

  1. Affected

    4.0.0

    1 release

3.x

  1. Affected

    3.0.0 – 3.1.1

    3 releases

2.x

  1. Affected

    2.0.0 – 2.0.2

    3 releases

1.x

  1. Affected

    1.0.0 – 1.1.0

    3 releases

0.x

  1. Affected

    0.0.2 – 0.2.1

    10 releases

117 stable releases of @astrojs/node, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for @astrojs/node. It is read in your browser and sent nowhere.

What happens

Summary

In the Astro Node adapter, a request whose Host header contains a malformed port (for example example.com:65536 or example.com:8080:8080) produced an invalid request URL. The fallback intended to recover from an unparseable URL reused the same malformed host, so it failed again and raised an uncaught TypeError: Invalid URL while the request was being built, before any route ran.

Impact

The effect depends on the adapter configuration:

  • Default configuration (standalone): the request returns 500 Internal Server Error and the server continues running.

  • With the opt-in staticHeaders: true option: the throw reaches a synchronous HTTP handler that does not catch it, becoming an uncaughtException that terminates the process.

This is an availability-only issue. It does not expose data or allow code execution. Triggering it requires sending a hand-crafted Host header, and many proxies and CDNs reject malformed hosts before they reach the origin.

Affected versions

@astrojs/node <= 11.1.2.

Patches

Fixed in @astrojs/node 11.1.3. When the incoming host cannot be parsed, the request URL now degrades to a host the server controls, so the request is handled instead of throwing. Hosts carrying more than a single hostname:port pair are also rejected during host validation.

Workarounds

Upgrade to @astrojs/node 11.1.3 or later. Deployments that terminate malformed Host headers at a reverse proxy or CDN are not reachable through this path.

Credits

Reported by @Celggar.