CVE-2026-41322: Astro Cache Poisoning Due to Malformed If-Match Header Handling
Summary
CVE-2026-41322: Astro: Cache Poisoning due to incorrect error handling when if-match header is malformed. Affects @astrojs/node versions < 10.0.5. Fixed in 10.0.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Astro is a modern static site generator that allows developers to build fast websites using their favorite frameworks. It optimizes the delivery of static assets like JavaScript and CSS, ensuring efficient loading times and improved user experience. However, a vulnerability has been identified in Astro's handling of the If-Match HTTP header, which can lead to cache poisoning, affecting the availability of static resources.
Vulnerability Detail
The vulnerability arises when a static JS/CSS resource is requested from the '_astro' path with an incorrect or malformed If-Match header. Instead of returning a 412 Precondition Failed error, the server responds with a 500 Internal Server Error and sets a one-year cache lifetime. This behavior causes subsequent requests for the same resource to receive a 5xx error until the cache expires, effectively poisoning the cache and rendering the asset unavailable to legitimate users. The issue is rooted in the error handling logic within the serve-static module of Astro, where the server fails to correctly interpret the error status code and defaults to a 500 response.
How To Fix
Minimum fixed version
10.0.5
This is the first release that contains the fix.
npm install @astrojs/node@10.0.5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not feasible, consider disabling caching for the affected resources or purging the cache after triggering the exploit. This can be done by configuring your CDN or server settings to avoid caching responses with 5xx errors.
Conclusion
In summary, CVE-2026-41322 is a vulnerability in Astro that can lead to cache poisoning due to improper handling of malformed If-Match headers. It is crucial for users of affected versions to update their packages to the latest patched versions to ensure the security and availability of their static resources.
See every vulnerability recorded for @astrojs/node →
FAQ
The vulnerability can lead to cache poisoning, where an attacker can force edge servers to cache an error page instead of the actual content, making resources unavailable to users until the cache expires.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The affected versions include astro@5.14.1 and @astrojs/node@9.4.4. Ensure you update to the patched versions to mitigate the vulnerability.
As a temporary measure, you can disable caching for the affected resources or purge the cache to prevent users from receiving the cached error responses.
The CVSS score of this vulnerability is 5.3, indicating a moderate level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for @astrojs/node.
