fix(deps): update dependency @astrojs/node to v11 [security] - autoclosed

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@astrojs/node (source)	^10.0.4 → ^11.0.0

---

@​astrojs/node: Backslash-prefixed paths not recognized as internal by trailing-slash redirect

CVE-2026-59730 / GHSA-r557-wffq-wvrc

More information

Details

Impact

With trailingSlash: 'always' configured, the @astrojs/node standalone server's static file handler appends a trailing slash to request paths and issues a 301 redirect. Paths beginning with /\ (slash-backslash) were not recognized as internal paths, so the handler would echo the raw path back in the Location header. Because browsers treat \ as / per the WHATWG URL specification, the resulting redirect could resolve to an external host.

Preconditions:

• trailingSlash: 'always' must be set (non-default; the default is 'ignore')
• The request path must not have a file extension in its final segment
• An attacker must deliver the crafted link to a user

Patches

Fixed by treating backslash-prefixed paths the same as //-prefixed paths in isInternalPath(), so they are no longer rewritten with a trailing slash.

Workarounds

Use the default trailingSlash: 'ignore' setting, which does not issue trailing-slash redirects in the static file handler.

References

• WHATWG URL spec: backslash normalization

Severity

• CVSS Score: 2.1 / 10 (Low)
• Vector String: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N

References

• https://github.com/withastro/astro/security/advisories/GHSA-r557-wffq-wvrc
• https://github.com/withastro/astro/pull/17252
• https://github.com/withastro/astro/commit/eb6f97e391ee587747e37609c255c7cd4b9cce3c
• https://github.com/withastro/astro/releases/tag/@astrojs/node@11.0.2
• https://nvd.nist.gov/vuln/detail/CVE-2026-59730
• https://github.com/advisories/GHSA-r557-wffq-wvrc

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Astro: Malformed port in the Host header can crash the Node adapter

CVE-2026-102984 / GHSA-qh8j-hqjv-7m4x

More information

Details

Summary

In the Astro Node adapter, a request whose Host header contains a malformed port (for example example.com:65536 or example.com:8080:8080) produced an invalid request URL. The fallback intended to recover from an unparseable URL reused the same malformed host, so it failed again and raised an uncaught TypeError: Invalid URL while the request was being built, before any route ran.

Impact

The effect depends on the adapter configuration:

• Default configuration (standalone): the request returns 500 Internal Server Error and the server continues running.
• With the opt-in staticHeaders: true option: the throw reaches a synchronous HTTP handler that does not catch it, becoming an uncaughtException that terminates the process.

This is an availability-only issue. It does not expose data or allow code execution. Triggering it requires sending a hand-crafted Host header, and many proxies and CDNs reject malformed hosts before they reach the origin.

Affected versions

@astrojs/node <= 11.1.2.

Patches

Fixed in @astrojs/node 11.1.3. When the incoming host cannot be parsed, the request URL now degrades to a host the server controls, so the request is handled instead of throwing. Hosts carrying more than a single hostname:port pair are also rejected during host validation.

Workarounds

Upgrade to @astrojs/node 11.1.3 or later. Deployments that terminate malformed Host headers at a reverse proxy or CDN are not reachable through this path.

Credits

Reported by @​Celggar.

Severity

• CVSS Score: 8.2 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

• https://github.com/withastro/astro/security/advisories/GHSA-qh8j-hqjv-7m4x
• https://nvd.nist.gov/vuln/detail/CVE-2026-102984
• https://github.com/withastro/astro/pull/17572
• https://github.com/withastro/astro/commit/2066f39c60707a100531b4ef4bb5dab8feafa7f2
• https://github.com/withastro/astro/releases/tag/@astrojs/node@11.1.3
• https://github.com/advisories/GHSA-qh8j-hqjv-7m4x

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

withastro/astro (@​astrojs/node)

v11.1.3

Compare Source

Patch Changes

• #​17636 51723b1 Thanks @​matthewp! - Updates the adapter to wait for the configured log destination through Astro's new app.getLogger() API. This release requires Astro 7.2.1 or later.

• Updated dependencies [8c193f6]:

  • @​astrojs/internal-helpers@0.10.3

v11.1.2

Compare Source

Patch Changes

• #​17400 c1cf110 Thanks @​tianrking! - Return a 404 instead of a 500 for unknown parameters that match a prerendered dynamic endpoint.

v11.1.1

Compare Source

Patch Changes

• #​17658 8b211a5 Thanks @​astrobot-houston! - Fixes an EventEmitter memory leak when serving static pages over keep-alive connections with staticHeaders enabled and CSP (security.csp) active

v11.1.0

Compare Source

Minor Changes

• #​16871 90c98ae Thanks @​adamchal! - When session: false is set in astro.config, the adapter no longer auto-wires the filesystem session driver. Combined with the matching astro change, this lets the session runtime tree-shake out of the server bundle.

Patch Changes

• #​17564 004fb0a Thanks @​dmgawel! - Fixes middleware mode routing when a prerendered dynamic route sorts before an on-demand fallback

v11.0.3

Compare Source

Patch Changes

• Updated dependencies [c895b12]:
  • @​astrojs/internal-helpers@0.10.2

v11.0.2

Compare Source

Patch Changes

• #​17252 eb6f97e Thanks @​matthewp! - Fixes trailing-slash handling for request paths that begin with a backslash

  With trailingSlash: 'always', the standalone Node server could append a trailing slash to a request path that begins with a backslash (for example /\example.com/foo) and echo that path back in the Location header of a 301 response. Because browsers resolve a leading \ the same way as /, the resulting Location could point off-site.

  Such paths are now recognized as internal paths, matching the existing handling for paths that begin with //, so they are no longer rewritten with a trailing slash.

• Updated dependencies [eb6f97e]:

  • @​astrojs/internal-helpers@0.10.1

v11.0.1

Compare Source

Patch Changes

• #​17249 02b73b0 Thanks @​ematipico! - Fixes an issue where the peerDependencies field used incorrect dependencies.

v11.0.0

Compare Source

Patch Changes

• #​17054 d426b67 Thanks @​astrobot-houston! - Fixes an issue where Astro files with non-ASCII characters in their name weren't correctly served after the build.

• #​17027 241250b Thanks @​ocavue! - Triggers beta prereleases for packages that are still on alpha

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Renovate PR Review Results

⚖️ Safety Assessment: ⚠️ Needs Manual Migration

🔍 Release Content Analysis

Security Vulnerabilities Addressed:

• CVE-2026-59730 (CVSS 2.1 / Low): Open redirect via backslash-prefixed paths with trailingSlash: 'always'

  • Backslash-prefixed paths (e.g., /\example.com/foo) were echoed in Location header of 301 redirect
  • Fixed in @astrojs/node@11.0.2
  • Precondition: trailingSlash: 'always' must be configured

• CVE-2026-102984 (CVSS 8.2 / High): Malformed Host header causes uncaughtException crash

  • Host: example.com:65536 triggers TypeError: Invalid URL during request construction
  • Default config (standalone): returns 500, server keeps running
  • With staticHeaders: true: becomes uncaught exception → process termination
  • Fixed in @astrojs/node@11.1.3
  • Precondition for process termination: staticHeaders: true must be configured

Breaking Change — Peer Dependency Bump:

• @astrojs/node@10.x: peerDependencies: astro: ^6.3.0
• @astrojs/node@11.x: peerDependencies: astro: ^7.2.1
• v11.1.3 changelog explicitly states: "This release requires Astro 7.2.1 or later" (uses new app.getLogger() API from Astro 7.2.1)

Other notable v11 changes:

• session: false now tree-shakes session runtime from server bundle (v11.1.0)
• Fix for EventEmitter memory leak with staticHeaders + CSP (v11.1.1)
• 404 instead of 500 for unknown parameters matching prerendered dynamic endpoints (v11.1.2)
• Non-ASCII filename serving fix (v11.0.0)
• Middleware mode routing fix for prerendered dynamic routes (v11.1.0)

🎯 Impact Scope Investigation

Usage in this project (astro.config.ts:70):

import node from '@astrojs/node';
// ...
output: 'static',
adapter: node({
  mode: 'standalone',
}),

Critical finding — neither CVE affects this project:

• trailingSlash is NOT configured → defaults to 'ignore' → CVE-2026-59730 trailing-slash redirect never fires
• staticHeaders is NOT set → CVE-2026-102984 crashes to 500 (not process termination) in default config; severity is reduced

Critical finding — peer dependency mismatch:

• This project uses astro@6.4.8
• @astrojs/node@11.x requires astro: ^7.2.1
• pnpm resolves the peer with Astro 6 anyway (no install error), but this is an unsupported configuration
• The app.getLogger() API used in v11.1.3 does not exist in Astro 6 → potential runtime failure

Dependency chain impact:

• @astrojs/internal-helpers bumped from 0.10.0 → 0.11.0
• No other packages affected in this PR

💡 Recommended Actions

1. Do NOT merge as-is. The peer dependency requires Astro 7.2.1+, but the project is on Astro 6.4.8. @astrojs/node@11 uses app.getLogger() (new in Astro 7.2.1), which will cause runtime errors.

2. Neither CVE requires immediate action for this project:

   • CVE-2026-59730: Requires trailingSlash: 'always' — not configured here
   • CVE-2026-102984 (High): The crash variant requires staticHeaders: true — not configured; default behavior degrades to 500, not process termination

3. Proper upgrade path:

   • Plan an Astro v6 → v7 upgrade first (separate PR, consult Astro v7 migration guide)
   • Once on Astro 7.2.1+, merge @astrojs/node@11 upgrade
   • After merge, verify pnpm build passes and Cloud Run deployment succeeds

4. As a risk mitigation (if immediate security fix is desired): Add trailingSlash: 'ignore' (already the default) and ensure staticHeaders is not set — both are already the case, so no configuration changes are needed for this project.

🔗 Reference Links

• GHSA-r557-wffq-wvrc (CVE-2026-59730) — Backslash open redirect (Low)
• GHSA-qh8j-hqjv-7m4x (CVE-2026-102984) — Malformed Host header crash (High)
• @astrojs/node CHANGELOG
• Astro Node adapter docs

Generated by koki-develop/claude-renovate-review

[github-actions]

🚀 Preview deployment ready!

✅ Preview URL: https://pr-1935---web-njpdbbjcea-an.a.run.app
📝 Commit SHA: acc43ce (view commit)

This comment was automatically generated by the deploy-preview workflow.