# CVE-2026-102984: Astro Node adapter denial of service in Host header parsing

Source: https://junglewise.ai/threats/cve-2026-102984-astro-is-a-web-framework-for-content-driven-websites-prior-to-11  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-30. Updated: 2026-09-30  
License: CC BY 4.0 with a link back

CVE-2026-102984 · Severity: high · CVSS 4 · Published 2026-09-30

Astro is a web framework for building content-driven websites. The Node.js adapter can crash when it receives HTTP requests with malformed port numbers in the Host header (such as example.com:65536). In the default configuration, the server returns a 500 error and stays running; however, when staticHeaders is enabled, the server process crashes completely, causing an outage. Proxies and CDNs typically filter these malformed headers before they reach the origin server.

Technologies: [@astrojs/node (npm)](https://junglewise.ai/threats/technologies/astrojs-node). Vendors: [Astro](https://junglewise.ai/threats/vendors/astro), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-102984 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-102984 being exploited in the wild.

**How severe is CVE-2026-102984?** High severity, with a CVSS score of 4, published 30 September 2026.

**Which products and versions are affected?** Astro @Astrojs/Node prior to 11.1.3; @astrojs/node (npm) <= 11.1.2, SEMVER:introduced=0,fixed=11.1.3.

**Is there a fix for CVE-2026-102984?** Yes. @astrojs/node (npm): upgrade to 11.1.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-102984 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-102984?** Check whether you run Astro @Astrojs/Node or @astrojs/node (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @astrojs/node (npm): upgrade to 11.1.3 or later

  ```sh
  npm install @astrojs/node@11.1.3
  ```


## Technical details

The @astrojs/node adapter constructs the request URL from the Host header without properly validating the port number. When a malformed port is encountered, the URL becomes invalid and throws a TypeError; the error recovery path reuses the same malformed host and throws again. The vulnerability affects availability only—no data exposure or code execution is possible. Fixed in version 11.1.3 by implementing a degradation strategy: if the incoming Host cannot be parsed, the request URL falls back to a server-controlled host.

## Affected products

- Astro @astrojs/node prior to 11.1.3

## Identifiers

- CVE-2026-102984
- GHSA-qh8j-hqjv-7m4x

## Timeline

- 2026-08-13: patched: Fix merged in commit 2066f39
- 2026-09-30: disclosed

## References

- [https://github.com/withastro/astro/commit/2066f39c60707a100531b4ef4bb5dab8feafa7f2](https://github.com/withastro/astro/commit/2066f39c60707a100531b4ef4bb5dab8feafa7f2)
- [https://github.com/withastro/astro/pull/17572](https://github.com/withastro/astro/pull/17572)

## Related threats

- [withastro Astro open redirect in @astrojs/node server](https://junglewise.ai/threats/cve-2026-59730-withastro-astro-open-redirect-in-astrojs-node-server)
- [Astro: Cache Poisoning due to incorrect error handling when if-match header is malformed](https://junglewise.ai/threats/cve-2026-41322-astro-cache-poisoning-due-to-incorrect-error-handling-when-if)
- [Astro Server Islands memory exhaustion DoS due to missing request body size limit](https://junglewise.ai/threats/cve-2026-29772-astro-astrojs-node-memory-exhaustion-dos-in-server-islands)
- [Astro memory exhaustion DoS in Server Actions](https://junglewise.ai/threats/cve-2026-27729-astro-memory-exhaustion-dos-in-server-actions)
- [Astro SSRF in remote image inferSize](https://junglewise.ai/threats/cve-2026-27829-astro-ssrf-in-remote-image-infersize)