CVE-2026-29772: Astro Package Memory Exhaustion DoS Due to Missing Request Body Size Limit
Summary
CVE-2026-29772: Astro: Memory exhaustion DoS due to missing request body size limit in Server Islands. Affects @astrojs/node versions < 10.0.0. Fixed in 10.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Astro is a modern static site generator that allows developers to build fast websites using components from various frameworks. It supports server-side rendering (SSR) and offers features like partial hydration through its Server Islands architecture. However, a vulnerability has been identified in the Astro package that affects its Server Islands functionality, specifically in how it handles incoming POST requests.
Vulnerability Detail
The vulnerability arises from Astro's Server Islands POST handler, which buffers and parses the entire request body as JSON without enforcing a size limit. This oversight allows an attacker to send a crafted payload of many small JSON objects, leading to significant memory amplification. The JSON.parse() function allocates a heap object for each element in the input, resulting in a scenario where a single unauthenticated request can exhaust the server's memory and crash the process. The vulnerability is present in all Astro SSR applications using the Node standalone adapter, as the vulnerable route is registered by default, regardless of whether any components utilize the server:defer feature.
How To Fix
Minimum fixed version
10.0.0
This is the first release that contains the fix.
npm install @astrojs/node@10.0.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement a middleware to limit the size of incoming request bodies before they reach the Astro server. For example, using Express.js, you can add the following middleware:
const express = require('express');
const app = express();
app.use(express.json({ limit: '1mb' }));
This will restrict the request body size to 1 MB, preventing large payloads from being processed.
Conclusion
The CVE-2026-29772 vulnerability in the Astro package poses a significant risk of memory exhaustion denial of service due to the lack of request body size limits. It is crucial for developers using Astro to update to the patched version to mitigate this risk. Implementing temporary workarounds can also help protect applications until the update is applied.
See every vulnerability recorded for @astrojs/node →
FAQ
CVE-2026-29772 is a vulnerability in the Astro package that allows for memory exhaustion denial of service (DoS) due to a lack of request body size limit in its Server Islands functionality.
Any Astro SSR application using the Node standalone adapter is affected, as the vulnerable route is registered by default.
You can use Vulert, which monitors open-source vulnerabilities in your software. By using the Vulert playground, you can check if your application is affected without needing to sign up.
An attacker can exploit this vulnerability to send a crafted request that exhausts the server's memory, leading to a crash and denial of service for legitimate users.
Yes, a patch is available in version 10.0.0 of the @astrojs/node package. Updating to this version will resolve the vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for @astrojs/node.
