[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@astrojs/node (source)	11.0.3 → 11.1.3

---

Astro: Malformed port in the Host header can crash the Node adapter

CVE-2026-102984 / GHSA-qh8j-hqjv-7m4x

More information

Details

Summary

In the Astro Node adapter, a request whose Host header contains a malformed port (for example example.com:65536 or example.com:8080:8080) produced an invalid request URL. The fallback intended to recover from an unparseable URL reused the same malformed host, so it failed again and raised an uncaught TypeError: Invalid URL while the request was being built, before any route ran.

Impact

The effect depends on the adapter configuration:

• Default configuration (standalone): the request returns 500 Internal Server Error and the server continues running.
• With the opt-in staticHeaders: true option: the throw reaches a synchronous HTTP handler that does not catch it, becoming an uncaughtException that terminates the process.

This is an availability-only issue. It does not expose data or allow code execution. Triggering it requires sending a hand-crafted Host header, and many proxies and CDNs reject malformed hosts before they reach the origin.

Affected versions

@astrojs/node <= 11.1.2.

Patches

Fixed in @astrojs/node 11.1.3. When the incoming host cannot be parsed, the request URL now degrades to a host the server controls, so the request is handled instead of throwing. Hosts carrying more than a single hostname:port pair are also rejected during host validation.

Workarounds

Upgrade to @astrojs/node 11.1.3 or later. Deployments that terminate malformed Host headers at a reverse proxy or CDN are not reachable through this path.

Credits

Reported by @​Celggar.

Severity

• CVSS Score: 8.2 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

• https://github.com/withastro/astro/security/advisories/GHSA-qh8j-hqjv-7m4x
• https://nvd.nist.gov/vuln/detail/CVE-2026-102984
• https://github.com/withastro/astro/pull/17572
• https://github.com/withastro/astro/commit/2066f39c60707a100531b4ef4bb5dab8feafa7f2
• https://github.com/withastro/astro/releases/tag/@astrojs/node@11.1.3
• https://github.com/advisories/GHSA-qh8j-hqjv-7m4x

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Astro: Malformed port in the Host header can crash the Node adapter

CVE-2026-102984 / GHSA-qh8j-hqjv-7m4x

More information

Details

Summary

In the Astro Node adapter, a request whose Host header contains a malformed port (for example example.com:65536 or example.com:8080:8080) produced an invalid request URL. The fallback intended to recover from an unparseable URL reused the same malformed host, so it failed again and raised an uncaught TypeError: Invalid URL while the request was being built, before any route ran.

Impact

The effect depends on the adapter configuration:

• Default configuration (standalone): the request returns 500 Internal Server Error and the server continues running.
• With the opt-in staticHeaders: true option: the throw reaches a synchronous HTTP handler that does not catch it, becoming an uncaughtException that terminates the process.

This is an availability-only issue. It does not expose data or allow code execution. Triggering it requires sending a hand-crafted Host header, and many proxies and CDNs reject malformed hosts before they reach the origin.

Affected versions

@astrojs/node <= 11.1.2.

Patches

Fixed in @astrojs/node 11.1.3. When the incoming host cannot be parsed, the request URL now degrades to a host the server controls, so the request is handled instead of throwing. Hosts carrying more than a single hostname:port pair are also rejected during host validation.

Workarounds

Upgrade to @astrojs/node 11.1.3 or later. Deployments that terminate malformed Host headers at a reverse proxy or CDN are not reachable through this path.

Credits

Reported by @​Celggar.

Severity

• CVSS Score: 8.2 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

• https://github.com/withastro/astro/security/advisories/GHSA-qh8j-hqjv-7m4x
• https://nvd.nist.gov/vuln/detail/CVE-2026-102984
• https://github.com/withastro/astro/pull/17572
• https://github.com/withastro/astro/commit/2066f39c60707a100531b4ef4bb5dab8feafa7f2
• https://github.com/withastro/astro
• https://github.com/withastro/astro/releases/tag/@astrojs/node@11.1.3

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

withastro/astro (@​astrojs/node)

v11.1.3

Compare Source

Patch Changes

• #​17636 51723b1 Thanks @​matthewp! - Updates the adapter to wait for the configured log destination through Astro's new app.getLogger() API. This release requires Astro 7.2.1 or later.

• Updated dependencies [8c193f6]:

  • @​astrojs/internal-helpers@0.10.3

v11.1.2

Compare Source

Patch Changes

• #​17400 c1cf110 Thanks @​tianrking! - Return a 404 instead of a 500 for unknown parameters that match a prerendered dynamic endpoint.

v11.1.1

Compare Source

Patch Changes

• Updated dependencies [7da442b]:
  • @​astrojs/internal-helpers@0.13.1

v11.1.0

Compare Source

Minor Changes

• #​16871 90c98ae Thanks @​adamchal! - When session: false is set in astro.config, the adapter no longer auto-wires the filesystem session driver. Combined with the matching astro change, this lets the session runtime tree-shake out of the server bundle.

Patch Changes

• #​17564 004fb0a Thanks @​dmgawel! - Fixes middleware mode routing when a prerendered dynamic route sorts before an on-demand fallback

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[ecv]

@astrojs/node security patch, lockfile only; checks green.