CVE-2026-102984

validated

GHSA-qh8j-hqjv-7m4x ↗EUVD-2026-89970 ↗

check availablenot proven exploitable

cve.orgpublic pockev

withastro astro <= 11.1.2

fixed in 11.1.3

CWE-248 Uncaught Exception

ETK-2026-121, permanent identifier

pkg:npm/@astrojs/node

cvss8.2cna vendorCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

+11h40mTTV

40mAI analysis

Check if you are vulnerable

timeline

0 = cve.org publication

trigger signal (cve.org) +0hcheck available+11h40magent stopped

+3h

+6h

+9h

description

@astrojs/node versions through 11.1.2 can mishandle malformed Host headers while constructing incoming request URLs. An attacker able to send such a header to the origin can cause failed requests and, when staticHeaders is enabled, terminate the Node process.

mitigation

Upgrade @astrojs/node to version 11.1.3 or later. Until upgraded, reject malformed Host headers at a reverse proxy or CDN before they reach the application.

fixed in 11.1.3

check

available

exploit

automation

contextual

auth required

EPSS

0.36%28th percentile

agent run time

40m

cve.org record, t = 0

2026-09-30 14:35Z

Δ to public poc

–

Δ to kev

–

outcome

Mechanism verified: the exploit fired on the vulnerable build and stayed silent on the patched one, but the server it ran against was ours, so no check ships for it.

source signals

Public signals that triggered or updated the pipeline. These are inputs for the deltas above.

2026-09-30 14:35Z
cve_org: trigger signal, started the run
https://www.cve.org/CVERecord?id=CVE-2026-102984

this entry in the feed

GET /api/v1/feed/CVE-2026-102984

{
  "etk_id": "ETK-2026-121",
  "cve_id": "CVE-2026-102984",
  "display_id": "CVE-2026-102984",
  "ghsa_id": "GHSA-qh8j-hqjv-7m4x",
  "euvd_id": "EUVD-2026-89970",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Malformed Host header denial of service in @astrojs/node",
  "summary": "@astrojs/node versions through 11.1.2 can mishandle malformed Host headers while constructing incoming request URLs. An attacker able to send such a header to the origin can cause failed requests and, when staticHeaders is enabled, terminate the Node process.",
  "mitigation": "Upgrade @astrojs/node to version 11.1.3 or later. Until upgraded, reject malformed Host headers at a reverse proxy or CDN before they reach the application.",
  "vendor": "withastro",
  "product": "astro",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "<= 11.1.2"
      ],
      "ecosystem": "npm",
      "fixed_versions": [
        "11.1.3"
      ],
      "package_name": "@astrojs/node",
      "purl": "pkg:npm/@astrojs/node"
    }
  ],
  "cwes": [
    248
  ],
  "cvss_score": 8.2,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
  "epss_score": 0.0036,
  "epss_percentile": 0.2864,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": true,
  "check_confidence_basis": "mechanism_verified",
  "exploit": false,
  "pipeline_minutes": 40.030167,
  "t0_at": "2026-09-30T14:35:22.323000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-01T02:15:12.799647+00:00",
      "days": 0.48600088711805556,
      "is_lower_bound": false,
      "measured_at": "2026-09-30T14:35:22.323000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-09-30T14:35:22.323000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-09-30T14:35:22.323000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-102984"
    }
  }
}

published 2026-09-30 15:14Z
last change 2026-10-21 07:05Z

Need the technical details behind an entry?

Every entry here shows what we attempted and when. The technical details, the generated exploit that fired it and the evidence behind the verdict are not public. Tell us about your use case and we’ll get back to you about extended API access.