CVE-2026-29772
published 2026-03-24CVE-2026-29772: Astro is a web framework. Prior to version 10.0.0, Astro's Server Islands POST handler buffers and parses the full request body as JSON without enforcing a…
PriorityP343high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.37%
28.9th percentile
Astro is a web framework. Prior to version 10.0.0, Astro's Server Islands POST handler buffers and parses the full request body as JSON without enforcing a size limit. Because JSON.parse() allocates a V8 heap object for every element in the input, a crafted payload of many small JSON objects achieves ~15x memory amplification (wire bytes to heap bytes), allowing a single unauthenticated request to exhaust the process heap and crash the server. The /_server-islands/[name] route is registered on all Astro SSR apps regardless of whether any component uses server:defer, and the body is parsed before the island name is validated, so any Astro SSR app with the Node standalone adapter is affected. This issue has been patched in version 10.0.0.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| astro | astrojs_node | >= 9.0.0 < 10.0.0 | 10.0.0 |
| astrojs | node | >= 0 < 10.0.0 | 10.0.0 |
| withastro | astro | < 10.0.0 | 10.0.0 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Astro: Memory exhaustion DoS due to missing request body size limit in Server Islands
ghsa·2026-03-24
CVE-2026-29772 [MEDIUM] CWE-770 Astro: Memory exhaustion DoS due to missing request body size limit in Server Islands
Astro: Memory exhaustion DoS due to missing request body size limit in Server Islands
### Summary
Astro's Server Islands POST handler buffers and parses the full request body as JSON without enforcing a size limit. Because `JSON.parse()` allocates a V8 heap object for every element in the input, a crafted payload of many small JSON objects achieves ~15x memory amplification (wire bytes to heap bytes), allowing a single unauthenticated request to exhaust the process heap and crash the server. The `/_server-islands/[name]` route is registered on all Astro SSR apps regardless of whether any component uses `server:defer`, and the body is parsed before the island name is validated, so any Astro SSR app with the Node standalone adapter is affected.
### Details
Astro automatically registers a
OSV
Astro: Memory exhaustion DoS due to missing request body size limit in Server Islands
osv·2026-03-24
CVE-2026-29772 [MEDIUM] Astro: Memory exhaustion DoS due to missing request body size limit in Server Islands
Astro: Memory exhaustion DoS due to missing request body size limit in Server Islands
### Summary
Astro's Server Islands POST handler buffers and parses the full request body as JSON without enforcing a size limit. Because `JSON.parse()` allocates a V8 heap object for every element in the input, a crafted payload of many small JSON objects achieves ~15x memory amplification (wire bytes to heap bytes), allowing a single unauthenticated request to exhaust the process heap and crash the server. The `/_server-islands/[name]` route is registered on all Astro SSR apps regardless of whether any component uses `server:defer`, and the body is parsed before the island name is validated, so any Astro SSR app with the Node standalone adapter is affected.
### Details
Astro automatically registers a
No detection rules found.
No public exploits indexed.
2026-03-24
Published