Full-read SSRF in the default `/_image` endpoint via the same Host header.
Does it affect you?
Not read yetConditions are read within the hour after an advisory comes in.
Root cause astro/app/node exports two request builders with opposite security postures: - createRequest() (line 123) validates the Host header against security.allowedDomains and falls back to localhost when it does not match, with the comment "Otherwise, fall back to 'localhost' to prevent SSRF attacks." - createRequestFromNodeRequest() (line 51) takes req.headers.host verbatim as the URL authority. No validation of any kind. @astrojs/node uses the unvalidated one on every request, in both serving modes: packages/integrations/node/src/serve-app.ts:99 createRequestFromNodeRequest(req, {...}) p
Timeline
12 Oct- Published by GitHub advisory12 Oct
- Seen by Patchwire23 Oct
- Fix released12 Oct
Versions of @astrojs/node
Packages
Stacks
Related alerts(1)
Same packagesSource summary
Summary In the Astro Node adapter, a request whose Host header contains a malformed port (for example example.com:65536 or example.com:8080:8080 ) produced an invalid request URL. The fallback intended to recover from an unparseable URL reused the same malformed host, so it failed again and raised an uncaught TypeError: Invalid URL while the request was being built, before any route ran. Impact The effect depends on the adapter configuration: - Default configuration ( standalone ): the request returns 500 Internal Server Error and the server continues running. - With the opt-in staticHeaders:
- Affected
- @astrojs/node <=11.1.2
- Fixed in
- 11.1.3
- ID
- GHSA-qh8j-hqjv-7m4x