CVE-2026-27729: Memory Exhaustion DoS in @astrojs/node Due to Missing Request Body Size Limit
Summary
CVE-2026-27729: Astro has memory exhaustion DoS due to missing request body size limit in Server Actions. Affects @astrojs/node versions >= 9.0.0, < 9.5.4. Fixed in 9.5.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Astro is a modern static site generator that allows developers to build fast websites using components from various frameworks. It supports server-side rendering (SSR) and provides server actions for handling incoming requests. The @astrojs/node package is an adapter that enables Astro to run in a Node.js environment, specifically in standalone mode. This package is designed to facilitate the deployment of Astro applications, but it has a critical vulnerability that can lead to denial of service (DoS) attacks due to the absence of a request body size limit.
Vulnerability Detail
The vulnerability arises from the fact that Astro server actions do not impose a default limit on the size of incoming request bodies. This oversight allows an attacker to send a single oversized POST request to a valid action endpoint, which can exhaust the server's memory and crash the process. In memory-constrained environments, this can lead to persistent crash-restart loops, severely impacting the availability of the application. The vulnerability is particularly concerning because action names are easily discoverable from public HTML pages, allowing unauthenticated users to exploit this flaw without any authentication barriers.
How To Fix
Minimum fixed version
9.5.4
This is the first release that contains the fix.
npm install @astrojs/node@9.5.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement a middleware that checks the size of incoming request bodies before they are processed by server actions. For example, you can use the following code snippet in your server setup:
const express = require('express');
const app = express();
const MAX_REQUEST_SIZE = 1 * 1024 * 1024; // 1 MB limit
app.use(express.json({ limit: MAX_REQUEST_SIZE }));
app.post('/_actions/echo', (req, res) => {
// Handle the request
});
Conclusion
The CVE-2026-27729 vulnerability in the @astrojs/node package poses a significant risk of memory exhaustion DoS attacks due to the absence of request body size limits. It is crucial to update to the patched version (9.5.4 or later) to mitigate this risk. Additionally, implementing a middleware can serve as a temporary solution until the update is applied.
See every vulnerability recorded for @astrojs/node →
FAQ
CVE-2026-27729 is a vulnerability in the @astrojs/node package that allows for memory exhaustion denial of service (DoS) attacks due to a lack of request body size limits.
An attacker can exploit this vulnerability by sending a single oversized POST request to a server action endpoint, which can crash the server due to memory exhaustion.
The main consequence is a denial of service, where the server becomes unavailable due to repeated crashes, especially in containerized environments.
You can use Vulert to monitor your application for this vulnerability. By analyzing your package-lock.json file, Vulert can alert you in real-time if your application is affected.
If you cannot update the package right away, consider implementing a middleware to limit the size of incoming request bodies as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for @astrojs/node.
