CVE-2026-29772 Astro: Memory exhaustion DoS due to missing request body size limit in Server Islands

Astro is a web framework. Prior to version 10.0.0, Astro's Server Islands POST handler buffers and parses the full request body as JSON without enforcing a size limit. Because JSON.parse allocates a V8 heap object for every element in the input, a crafted payload of many small JSON objects achiev...

CVE-2026-29772

Astro Server Islands vulnerability CVE-2026-29772 affects Astro SSR apps using the Node standalone adapter prior to version 10.0.0. The POST handler buffers the entire request body and parses it as JSON without any size limit, causing JSON.parse() to allocate many V8 objects and produce memory am...

CVE-2026-33768

creationtimestamp| type| source ---|---|--- 2026-03-24 18:12:25+00:00| published-proof-of-concept| https://github.com/withastro/astro/security/advisories/GHSA-mr6q-rp88-fx84...

CVE-2026-29772

creationtimestamp| type| source ---|---|--- 2026-03-24 18:11:06+00:00| published-proof-of-concept| https://github.com/withastro/astro/security/advisories/GHSA-3rmj-9m5h-8fpv...

CVE-2026-33769

creationtimestamp| type| source ---|---|--- 2026-03-24 18:10:56+00:00| published-proof-of-concept| https://github.com/withastro/astro/security/advisories/GHSA-g735-7g2w-hh3f...

Astro input validation error vulnerability

Astro is a content-driven website framework developed by Astro OpenSource. Versions of Astro from 2.10.10 to 5.18.1 had a vulnerability related to input validation errors. This vulnerability stemmed from defects in the path matching logic of remotePatterns, which could allow access to paths that...

PT-2026-27479

Name of the Vulnerable Software and Affected Versions Astro versions prior to 10.0.0 Description Astro's Server Islands POST handler does not enforce a size limit when buffering and parsing JSON request bodies. The JSON.parse function allocates a V8 heap object for each element in the input,...

Astro security vulnerabilities

Astro is a content-driven website framework developed by Astro OpenSource. Versions of Astro prior to 10.0.0 contained security vulnerabilities. These vulnerabilities stemmed from the Server Islands POST processor, which unlimitedly buffered and parsed the entire request body as JSON, potentially...

PT-2026-27488

Name of the Vulnerable Software and Affected Versions Astro versions 2.10.10 through 5.18.0 Description Astro’s remotePatterns path enforcement for remote URLs used by server-side fetchers, such as the image optimization endpoint, is affected by an issue. The path matching logic for / wildcards i...

Astro security vulnerabilities

Astro is a content-driven website framework developed by Astro OpenSource. Versions of Astro prior to 10.0.2 contained security vulnerabilities. These vulnerabilities stemmed from the lack of authentication when reading the x-astro-path header and the xastropath query parameters, which could lead...

PT-2026-27487

Name of the Vulnerable Software and Affected Versions Astro versions prior to 10.0.2 Description Astro, a web framework, contains a flaw in the @astrojs/vercel serverless entrypoint. Versions prior to 10.0.2 do not authenticate requests using the x-astro-path header or x astro path query paramete...

CVE-2026-33769: Improper Input Validation

Astro is a web framework. From version 2.10.10 to before version 5.18.1, this issue concerns Astro's remotePatterns path enforcement for remote URLs used by server-side fetchers such as the image optimization endpoint. The path matching logic for / wildcards is unanchored, so a pathname that...

CVE-2026-33768: Unintended Proxy or Intermediary

Astro is a web framework. Prior to version 10.0.2, the @astrojs/vercel serverless entrypoint reads the x-astro-path header and xastropath query parameter to rewrite the internal request path, with no authentication whatsoever. On deployments without Edge Middleware, this lets anyone bypass Vercel...

CVE-2026-29772: Allocation of Resources Without Limits or Throttling

Astro is a web framework. Prior to version 10.0.0, Astro's Server Islands POST handler buffers and parses the full request body as JSON without enforcing a size limit. Because JSON.parse allocates a V8 heap object for every element in the input, a crafted payload of many small JSON objects achiev...

PT-2026-24821

Summary The updateUserNotifications endpoint accepts a user ID from the request payload and uses it to update that user's notification preferences. It checks that the caller is logged in but never verifies that the caller owns the target account id !== userData.user.id. Any authenticated visitor...

CVE-2026-30944: Authorization Bypass Through User-Controlled Key

StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.0, the /studiocmsapi/dashboard/api-tokens endpoint allows any authenticated user at least Editor to generate API tokens for any other user, including owner and admin accounts. The endpoint fails to...

Server-side Request Forgery (SSRF)

Overview astro is an Astro is a modern site builder with web best practices, performance, and DX front-of-mind. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the inferSize option that fetches remote images at render time to determine their dimensions. An...

@1771technologies/oneplay (>=0.0.1, <=0.0.6), @antonyfaris/prefix-node-builtins (>=1.0.0, <=1.0.1) +39 more potentially affected by CVE-2026-27829 via astro (>=5.0.0-beta.5, <=5.17.2)

astro NPM version =5.0.0-beta.5, =0.0.1, =1.0.0, =0.5.0, =0.0.1, =0.1.0, =0.0.1, =2.0.0, =2.18.7, =1.25.426-4, =0.6.2, =0.1.2-alpha.1, =0.0.28, =0.0.28, =0.0.40 and more Source cves: CVE-2026-27829 Source advisory: SNYK:JS-ASTRO-15357600...

CVE-2026-27829

Astro is a web framework. In versions 9.0.0 through 9.5.3, a bug in Astro's image pipeline allows bypassing image.domains / image.remotePatterns restrictions, enabling the server to fetch content from unauthorized remote hosts. Astro provides an inferSize option that fetches remote images at rend...

CVE-2026-27829

Astro is a web framework. In versions 9.0.0 through 9.5.3, a bug in Astro's image pipeline allows bypassing image.domains / image.remotePatterns restrictions, enabling the server to fetch content from unauthorized remote hosts. Astro provides an inferSize option that fetches remote images at rend...