CVE-2026-29772

The record

Astro is a web framework. Prior to version 10.0.0, Astro's Server Islands POST handler buffers and parses the full request body as JSON without enforcing a size limit. Because JSON.parse() allocates a V8 heap object for every element in the input, a crafted payload of many small JSON objects achieves ~15x memory amplification (wire bytes to heap bytes), allowing a single unauthenticated request to exhaust the process heap and crash the server. The /_server-islands/[name] route is registered on all Astro SSR apps regardless of whether any component uses server:defer, and the body is parsed before the island name is validated, so any Astro SSR app with the Node standalone adapter is affected. This issue has been patched in version 10.0.0.

Affected packages

Related vulnerabilities

• GHSA-3rmj-9m5h-8fpv Astro: Memory exhaustion DoS due to missing request body size limit in Server Islands Same vulnerability
• CVE-2026-41322 @astrojs/node allows Astro to deploy your SSR site to Node targets. Also affects @astrojs/node
• GHSA-c57f-mm3j-27q9 Astro: Cache Poisoning due to incorrect error handling when if-match header is malformed Also affects @astrojs/node
• CVE-2026-27829 Astro is a web framework. Also affects @astrojs/node
• GHSA-jm64-8m5q-4qh8 Astro has memory exhaustion DoS due to missing request body size limit in Server Actions Also affects @astrojs/node
• GHSA-cj9f-h6r6-4cx2 Astro is vulnerable to SSRF due to missing allowlist enforcement in remote image inferSize Also affects @astrojs/node
• CVE-2026-27729 Astro is a web framework. Also affects @astrojs/node
• CVE-2026-25545 Astro is a web framework. Also affects @astrojs/node