Astro Node Adapter CVE-2026-102984

Requires the site to be served by the @astrojs/node adapter (versions prior to 11.1.3) and reachable such that a client-supplied Host header with a malformed port (invalid port number like :65536/:99999/:-1/:abc, or a duplicated port like example.com:8080:8080) reaches the origin. Full impact (Node process termination) requires the non-default staticHeaders option to be ENABLED; in the default standalone configuration the flaw only causes an HTTP 500 with the server remaining up. LIMITING FACTORS: any fronting proxy or CDN that rejects malformed Host headers blocks the request before it reaches the origin, neutralizing the attack; impact is availability-only with no data exposure or code execution.

This is a genuine but bounded availability issue, not a high-impact security event despite the 8.2 CVSS 4.0 score. The vendor vector (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H) correctly reflects a network-reachable, unauthenticated, low-complexity trigger with attack-requirement AT:P - the elevated impact (full Node process termination) only occurs when the non-default staticHeaders option is enabled; in the default standalone configuration the same malformed Host merely yields an HTTP 500 and the server keeps running. The confidentiality/integrity metrics are correctly zeroed (VC:N/VI:N) - the description and CWE-248 (Uncaught Exception) confirm availability-only impact with no data exposure or code execution. There is no EPSS score, no CISA KEV listing, and no public exploit provided in the input, so this is 'no public exploit identified at time of analysis' - although the fix commit, PR diff, and unit tests publicly document the exact malformed inputs (e.g. example.com:65536, example.com:8080:8080), which materially lowers the barrier to weaponizing a crasher. Key mitigating signal explicitly stated in the advisory: front-end proxies and CDNs that reject malformed Host headers prevent the request from ever reaching the origin, so many production deployments behind a CDN are not exposed. Net: real but low-to-moderate priority, driven by the availability-only impact and the dependency on the staticHeaders configuration for the severe (process-kill) variant.

An unauthenticated remote attacker sends a raw HTTP request to an Astro site served by @astrojs/node with a malformed port in the Host header, such as Host: example.com:65536 or example.com:8080:8080. When the site runs with staticHeaders enabled, the synchronous handler fails to catch the resulting TypeError: Invalid URL and the Node process terminates, denying service; in the default standalone mode the same request only returns HTTP 500. No public exploit is shipped, but the fixed PR and its test cases openly enumerate the triggering host strings.