CVE-2026-41322: Astro: Cache Poisoning due to incorrect error handling when if-match header is malformed

CVE-2026-41322 · Severity: medium · CVSS 5.3 · Published 2026-04-24

Astro is a web framework used to build and serve static websites and single-page applications. When an attacker sends a malformed if-match HTTP header to request static assets (CSS/JavaScript files), the framework incorrectly returns a 500 error with aggressive caching headers instead of the expected 412 error. This causes edge caches and CDNs to cache the error page for one year, breaking the website for all users until the cache expires.

Technologies: @astrojs/node (npm). Vendors: npm.

Quick answers

Is CVE-2026-41322 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-41322 being exploited in the wild.
How severe is CVE-2026-41322?
Medium severity, with a CVSS score of 5.3, published 24 April 2026.
Which products and versions are affected?
@astrojs/node (npm) < 10.0.5, SEMVER:introduced=0,fixed=10.0.5.
Is there a fix for CVE-2026-41322?
Yes. @astrojs/node (npm): upgrade to 10.0.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-41322 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-41322?
Check whether you run @astrojs/node (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @astrojs/node (npm): upgrade to 10.0.5 or later
    npm install @astrojs/node@10.0.5

Technical details

The vulnerability is a cache poisoning issue in the @astrojs/node adapter's serve-static.ts file. When the Node.js send library processes a conditional request (if-match header) and detects an ETag mismatch, it emits a 'file' event (setting forwardError = true), then a 'headers' event (which applies long-lived cache headers), and finally an 'error' event with a PreconditionFailedError (status 412). However, the error handler unconditionally calls res.writeHead(500) without inspecting the actual error status code, resulting in a 500 response with Cache-Control: public, max-age=31536000, immutable already set. The attack requires network access and no authentication; an attacker can trigger this by sending a single curl request with a malformed if-match header. The fix is available in @astrojs/node version 10.0.5 and later.

Affected products

  • Astro Astro 5.14.1
  • Astro @astrojs/node 9.4.4 and earlier; fixed in 10.0.5

Identifiers

  • CVE-2026-41322
  • GHSA-c57f-mm3j-27q9

Timeline

  • 2026-04-20: disclosed: Advisory published
  • 2026-04-23: patched: @astrojs/node 10.0.5 released with fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.