What is the CVSS score of CVE-2026-29772?

CVE-2026-29772 has a CVSS 3.1 base score of 5.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of Astro are affected by CVE-2026-29772?

Organizations using Astro should be aware of moderate risk from CVE-2026-29772 rated CVSS 5.9. Exploitation could compromise the security of affected deployments.. A patch is available.

How to fix or mitigate CVE-2026-29772?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Astro CVE-2026-29772

EUVD-2026-14962 MEDIUM

Allocation of Resources Without Limits or Throttling (CWE-770)

2026-03-24 GitHub_M

GHSA-3rmj-9m5h-8fpv

Denial Of Service Astro

5.9

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.9 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 24, 2026 - 19:00 euvd

EUVD-2026-14962

Analysis Generated

Mar 24, 2026 - 19:00 vuln.today

CVE Published

Mar 24, 2026 - 18:38 nvd

MEDIUM 5.9

DescriptionGitHub Advisory

Astro is a web framework. Prior to version 10.0.0, Astro's Server Islands POST handler buffers and parses the full request body as JSON without enforcing a size limit. Because JSON.parse() allocates a V8 heap object for every element in the input, a crafted payload of many small JSON objects achieves ~15x memory amplification (wire bytes to heap bytes), allowing a single unauthenticated request to exhaust the process heap and crash the server. The /_server-islands/[name] route is registered on all Astro SSR apps regardless of whether any component uses server:defer, and the body is parsed before the island name is validated, so any Astro SSR app with the Node standalone adapter is affected. This issue has been patched in version 10.0.0.

AnalysisAI

Astro web framework versions prior to 10.0.0 contain an unbounded JSON parsing vulnerability in the Server Islands POST handler that allows unauthenticated remote attackers to exhaust server memory and cause denial of service. The vulnerability affects all Astro SSR applications using the Node standalone adapter, regardless of whether Server Islands functionality is actually used, because the request body is parsed before route validation occurs. An attacker can craft a payload containing many small JSON objects to achieve approximately 15x memory amplification, crashing the process with a single malicious request.

Technical ContextAI

The vulnerability exists in Astro's (cpe:2.3:a:withastro:astro) Server Islands implementation, specifically the /_server-islands/[name] route handler. The root cause is classified as CWE-770 (Allocation of Resources Without Limits or Throttling), where the application fails to enforce request body size limits before invoking JSON.parse(). The V8 JavaScript engine allocates heap memory proportionally to JSON structure complexity; an attacker exploits this by sending deeply nested or numerous JSON objects that force excessive heap allocation. The route is automatically registered on all SSR deployments using the Node standalone adapter, and critically, body parsing occurs before the island name parameter is validated, making every Astro SSR instance a potential target regardless of configured features.

RemediationAI

Upgrade Astro to version 10.0.0 or later immediately, as the patch is already available and fully resolves the vulnerability. For organizations unable to upgrade immediately, implement a reverse proxy (such as Nginx or cloud load balancer) with request body size limits enforced before traffic reaches the Astro application; configure JSON payload size limits to block requests exceeding typical legitimate sizes (e.g., 1-10 MB depending on use case). Additionally, restrict network access to the Astro SSR application to trusted upstream sources only and implement request rate limiting on the /_server-islands route to further mitigate automated exploitation. Monitor process memory consumption and configure alerts for unusual heap growth patterns. See the official advisory at https://github.com/withastro/astro/security/advisories/GHSA-3rmj-9m5h-8fpv for patch deployment details.