CVE-2026-27729 Astro has memory exhaustion DoS due to missing request body size limit in Server Actions
Unauthenticated attackers can crash Astro server actions by sending oversized requests, causing memory exhaustion and denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-27729?
CVE-2026-27729 is a medium-severity denial of service vulnerability in withastro astro, published on 24 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Astro is a web framework. In versions 9.0.0 through 9.5.3, Astro server actions have no default request body size limit, which can lead to memory exhaustion DoS. A single large POST to a valid action endpoint can crash the server process on memory-constrained deployments. On-demand rendered sites built with Astro can define server actions, which automatically parse incoming request bodies (JSON or FormData). The body is buffered entirely into memory with no size limit — a single oversized request is sufficient to exhaust the process heap and crash the server. Astro's Node adapter (`mode: 'standalone'`) creates an HTTP server with no body size protection. In containerized environments, the crashed process is automatically restarted, and repeated requests cause a persistent crash-restart loop. Action names are discoverable from HTML form attributes on any public page, so no authentication is required. The vulnerability allows unauthenticated denial of service against SSR standalone deployments using server actions. A single oversized request crashes the server process, and repeated requests cause a persistent crash-restart loop in containerized environments. Version 9.5.4 contains a fix.
Weakness: CWE-770
Which versions are affected by CVE-2026-27729?
2 open source packages ship an affected version, including @astrojs/node. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
@astrojs/node npm | From 9.0.0 | 9.5.4 |
@astrojs/node npm | From 9.0.0 | 9.5.4 |
Products include Astro \@Astrojs\/Node.
How do I fix CVE-2026-27729?
Upgrade @astrojs/node to 9.5.4 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-27729 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-27729 exists.
Other vulnerabilities in withastro astro
Sources
Also known as GHSA-jm64-8m5q-4qh8.