@astrojs/node
11.1.9 · 19 Oct 2026MIT577.2k / weekRepositoryHomepagenpmAtom feed
Security advisories
From OSV, open ones first. Each release line gets its own fix: an older major is fixed by a patch on that major, not by moving to the newest one.
Is your project affected?
Paste your package.json, or type the range you declare for @astrojs/node. It is read in your browser and sent nowhere.
| Line | Newest | Where it stands |
|---|---|---|
| 11.1.9 | Safe from 11.1.3 | |
| 10.1.4 | 2 open advisories, worst high | |
| 9.5.5 | 4 open advisories, worst high | |
| 8.3.4 | 67 open advisories, worst high · last release Sep 2024, no longer updated |
- HighAstro: Malformed port in the Host header can crash the Node adapterGHSA-qh8j-hqjv-7m4x · 30 Sep 2026
- 11.x11.0.0 – 11.1.2Fixed in 11.1.3
- 10.x10.0.0 – 10.1.4No fix on 10.x · move to 11.1.3
- 9.x9.0.0 – 9.5.5No fix on 9.x · move to 11.1.3
- 8.x and older0.0.2 – 8.3.4No fix, no longer updated · move to 11.1.3
- ModerateAstro: Cache Poisoning due to incorrect error handling when if-match header is malformed GHSA-c57f-mm3j-27q9 · 23 Apr 2026
- 10.x10.0.0 – 10.0.4Fixed in 10.0.5
- 9.x9.0.0 – 9.5.5No fix on 9.x · move to 10.0.5
- 8.x and older0.0.2 – 8.3.4No fix, no longer updated · move to 10.0.5
- ModerateAstro: Memory exhaustion DoS due to missing request body size limit in Server IslandsGHSA-3rmj-9m5h-8fpv · 24 Mar 2026
- 9.x9.0.0 – 9.5.5No fix on 9.x
- 8.x and older0.0.2 – 8.3.4No fix, no longer updated
- ModerateAstro has memory exhaustion DoS due to missing request body size limit in Server ActionsGHSA-jm64-8m5q-4qh8 · 25 Feb 2026
- 9.x9.0.0 – 9.5.3Fixed in 9.5.4
- ModerateAstro is vulnerable to SSRF due to missing allowlist enforcement in remote image inferSizeGHSA-cj9f-h6r6-4cx2 · 25 Feb 2026
- 9.x9.0.0 – 9.5.3Fixed in 9.5.4
- ModerateAstro has Full-Read SSRF in error rendering via Host: header injectionGHSA-qq67-mvv5-fw3g · 23 Feb 2026
- 9.x9.0.0 – 9.5.3Fixed in 9.5.4
- 8.x and older0.0.2 – 8.3.4No fix, no longer updated · move to 9.5.4
- ModerateAstro allows unauthorized third-party images in _image endpointGHSA-xf8x-j4p2-f749 · 19 Aug 2025
- 9.x9.0.0 – 9.1.0Fixed in 9.1.1
- 8.x and older0.0.2 – 8.3.4No fix, no longer updated · move to 9.1.1
- Moderate@astrojs/node's trailing slash handling causes open redirect issueGHSA-9x9c-ghc5-jhw9 · 15 Aug 2025
- 9.x9.0.0 – 9.4.0Fixed in 9.4.1
- 8.x and older0.0.2 – 8.3.4No fix, no longer updated · move to 9.4.1
- Low@astrojs/node: Backslash-prefixed paths not recognized as internal by trailing-slash redirectGHSA-r557-wffq-wvrc · 20 Jul 2026
- 11.x11.0.0 – 11.0.1Fixed in 11.0.2
- 10.x10.0.0 – 10.1.4No fix on 10.x · move to 11.0.2
- 9.x9.0.0 – 9.5.5No fix on 9.x · move to 11.0.2
- 8.x8.1.0 – 8.3.4No fix on 8.x · move to 11.0.2
Registry facts last checked 22 Oct 2026. Releases and advisories last read 22 Oct 2026.