Astro: Malformed port in the Host header can crash the Node adapter.
Does it affect you?
Not read yetConditions are read within the hour after an advisory comes in.
Summary In the Astro Node adapter, a request whose Host header contains a malformed port (for example example.com:65536 or example.com:8080:8080 ) produced an invalid request URL. The fallback intended to recover from an unparseable URL reused the same malformed host, so it failed again and raised an uncaught TypeError: Invalid URL while the request was being built, before any route ran. Impact The effect depends on the adapter configuration: - Default configuration ( standalone ): the request returns 500 Internal Server Error and the server continues running. - With the opt-in staticHeaders:
Timeline
30 Sep- Published by GitHub advisory database30 Sep
- Seen by Patchwire23 Oct
- Fix released30 Sep
Versions of @astrojs/node
Packages
Stacks
Related alerts(1)
Same packagesSource summary
Root cause astro/app/node exports two request builders with opposite security postures: - createRequest() (line 123) validates the Host header against security.allowedDomains and falls back to localhost when it does not match, with the comment "Otherwise, fall back to 'localhost' to prevent SSRF attacks." - createRequestFromNodeRequest() (line 51) takes req.headers.host verbatim as the URL authority. No validation of any kind. @astrojs/node uses the unvalidated one on every request, in both serving modes: packages/integrations/node/src/serve-app.ts:99 createRequestFromNodeRequest(req, {...}) p
- Affected
- @astrojs/node <=11.1.6
- Fixed in
- 11.1.7
- ID
- GHSA-m8p5-r7qv-cx4c