{"answers":{"affected":"2 open source packages ship an affected version, including @astrojs/node. It affects 1 product.","exploited":"It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-27729 exists.","fix":"Upgrade @astrojs/node to 9.5.4 or later.","what":"CVE-2026-27729 is a medium-severity denial of service vulnerability in withastro astro, published on 24 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-27729 and fix it if it is affected.\n\nWhat it is: CVE-2026-27729 is a medium-severity denial of service vulnerability in withastro astro, published on 24 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-27729 exists.\n\nAffected packages and fixed versions:\n- @astrojs/node (npm): affected from 9.0.0; fixed in 9.5.4\n- @astrojs/node (npm): affected from 9.0.0; fixed in 9.5.4\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-27729/ (Markdown: https://insights.sbomify.com/CVE-2026-27729/index.md)","id":"CVE-2026-27729","markdown":"https://insights.sbomify.com/CVE-2026-27729/index.md","name":"CVE-2026-27729","record":{"aliases":["GHSA-jm64-8m5q-4qh8"],"analysis":{"component_type":"web_application","fix_type":"upgrade","impacts":["denial_of_service"],"network_reachable":"yes","non_default_config":false,"product_category":"Astro web framework","requires_auth":"none","summary":"Unauthenticated attackers can crash Astro server actions by sending oversized requests, causing memory exhaustion and denial of service.","user_interaction":"not_required","vuln_class":"denial_of_service"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[{"product":"\\@astrojs\\/node","vendor":"astro"}],"cvss":{"score":5.9,"severity":"medium","source":"cna","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"cwes":[{"id":"CWE-770","name":"Allocation of Resources Without Limits or Throttling"}],"description":"Astro is a web framework. In versions 9.0.0 through 9.5.3, Astro server actions have no default request body size limit, which can lead to memory exhaustion DoS. A single large POST to a valid action endpoint can crash the server process on memory-constrained deployments. On-demand rendered sites built with Astro can define server actions, which automatically parse incoming request bodies (JSON or FormData). The body is buffered entirely into memory with no size limit — a single oversized request is sufficient to exhaust the process heap and crash the server. Astro's Node adapter (`mode: 'standalone'`) creates an HTTP server with no body size protection. In containerized environments, the crashed process is automatically restarted, and repeated requests cause a persistent crash-restart loop. Action names are discoverable from HTML form attributes on any public page, so no authentication is required. The vulnerability allows unauthenticated denial of service against SSR standalone deployments using server actions. A single oversized request crashes the server process, and repeated requests cause a persistent crash-restart loop in containerized environments. Version 9.5.4 contains a fix.","ecosystems":["npm"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"weaponised"},"has_fix":true,"headline":"Astro has memory exhaustion DoS due to missing request body size limit in Server Actions","id":"CVE-2026-27729","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"npm","product":null,"products":[],"type":"denial_of_service","year":"2026"},"n_packages":2,"n_references":4,"next":{"headline":"esm.sh has SSRF localhost/private-network bypass in `/http(s)` module route","id":"CVE-2026-27730"},"packages":[{"ecosystem":"npm","fixed":["9.5.4"],"introduced":["9.0.0"],"last_affected":[],"package":"@astrojs/node","purl":null,"source":"GHSA-jm64-8m5q-4qh8"},{"ecosystem":"npm","fixed":["9.5.4"],"introduced":["9.0.0"],"last_affected":[],"package":"@astrojs/node","purl":"pkg:npm/%40astrojs/node","source":"GHSA-jm64-8m5q-4qh8"}],"prev":{"headline":"OneUptime: OS Command Injection in Probe NetworkPathMonitor via unsanitized destination in traceroute exec()","id":"CVE-2026-27728"},"products":["astro"],"published":"2026-02-24","related":[{"cvss_score":6.9,"headline":"Astro has Full-Read SSRF in error rendering via Host: header injection","id":"CVE-2026-25545","kev_date_added":null,"published":"2026-02-24"},{"cvss_score":6.5,"headline":"Astro is vulnerable to SSRF due to missing allowlist enforcement in remote image inferSize","id":"CVE-2026-27829","kev_date_added":null,"published":"2026-02-26"},{"cvss_score":5.9,"headline":"Astro: Memory exhaustion DoS due to missing request body size limit in Server Islands","id":"CVE-2026-29772","kev_date_added":null,"published":"2026-03-24"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"poc","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-02-26","vendors":["withastro"]},"summary":"Unauthenticated attackers can crash Astro server actions by sending oversized requests, causing memory exhaustion and denial of service.","url":"https://insights.sbomify.com/CVE-2026-27729/"}