Astro Node Integration CVE-2026-41322

The vulnerability requires the following conditions: (1) Application must be deployed using @astrojs/node version 9.4.4 or earlier; (2) Application must serve immutable static assets from the _astro directory (default Astro configuration); (3) Attacker must have network access to the application (typically internet-facing); (4) CDN or origin caching must be configured to cache responses based on URL only, without segmenting cache keys by conditional headers such as if-match (this is a common misconfiguration but not universal). If the CDN already segments cache keys by the if-match header value, the poisoned response affects only subsequent requests with the same malformed header value, greatly reducing real-world impact. No user interaction is required. Exploitation does not require authentication. The attack is not limited to specific browser types or platforms. The vulnerability is exacerbated by the immutable static file naming scheme (content hashes in filenames), which is standard Astro practice and leads to one-year cache lifetimes that prolong the impact window.

This vulnerability presents a moderate real-world risk despite the 5.3 CVSS score. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) correctly reflects network-accessible, unauthenticated, low-complexity exploitation with availability impact only. However, the severity in practice depends heavily on CDN configuration and deployment topology. The vulnerability only manifests as a persistent problem if the CDN caches conditional request headers as part of the cache key; the vendor's own testing environment mitigated this by including if-match in cache keys, preventing poisoning. The impact rating of 'Availability' is accurate: the attack causes asset 503/500 errors until cache expiration, degrading application functionality. The 31,536,000-second (one-year) cache lifetime is intentional for immutable hashed assets but becomes dangerous when paired with 500 errors. This is not a high-CVSS-but-low-risk issue; rather, it is a correctly-rated vulnerability whose real-world impact is deployment-dependent. Organizations using aggressive CDN caching without conditional-header-based cache segmentation face significantly higher risk. No EPSS score or exploitation metrics are provided in the input, so baseline CVSS is the primary signal; CISA KEV status is unknown.

An attacker sends a single curl request with a malformed if-match header (e.g., 'if-match: xxx') to any static asset in the _astro directory of an Astro application using the vulnerable Node integration (e.g., curl -H 'if-match: xxx' https://example.com/_astro/style.abc123.css). The server incorrectly returns HTTP 500 Internal Server Error with Cache-Control: public, max-age=31536000, immutable headers. The CDN (e.g., CloudFront) caches this 500 error response. All subsequent legitimate requests to that asset-regardless of whether they include the if-match header-receive the cached 500 error instead of the CSS or JavaScript file, breaking the application's styling or functionality for all visitors sharing the same CDN edge node until the one-year cache expires.