Astro CVE-2026-29772

The CVSS 5.9 score (Medium severity) with vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H reflects a network-accessible vulnerability requiring no authentication but with High attack complexity. The AC:H constraint indicates the attacker must craft a specific payload format to trigger the condition, not a trivial exploit. However, the practical risk is elevated: the vulnerability is unauthenticated and affects all Astro SSR deployments by default, making it trivially automatable and widely exploitable. The technical impact is high (denial of service causing process crash), and given Astro's popularity in the JavaScript ecosystem, this represents significant real-world exposure. The availability impact (A:H) is the sole concern, but in production environments DoS vulnerabilities frequently warrant immediate patching. Without KEV status or confirmed POC availability details, this appears to be a high-priority but not critical issue for production deployments relying on Astro SSR.

An unauthenticated attacker sends a POST request to any Astro SSR application at the /_server-islands/malicious endpoint with a crafted JSON payload containing thousands of small objects or deeply nested structures. The Astro handler immediately begins parsing the entire body without size validation, causing the V8 engine to allocate heap memory at approximately 15 times the wire payload size. Within seconds, the Node.js process exhausts available heap memory and crashes, rendering the application unavailable until manual restart. Because the route is automatically registered and parsing occurs before route validation, no specific Server Islands configuration is required to make an application vulnerable.