Source summary

Root cause astro/app/node exports two request builders with opposite security postures: - createRequest() (line 123) validates the Host header against security.allowedDomains and falls back to localhost when it does not match, with the comment "Otherwise, fall back to 'localhost' to prevent SSRF attacks." - createRequestFromNodeRequest() (line 51) takes req.headers.host verbatim as the URL authority. No validation of any kind. @astrojs/node uses the unvalidated one on every request, in both serving modes: packages/integrations/node/src/serve-app.ts:99 createRequestFromNodeRequest(req, {...}) p

Affected

@astrojs/node <=11.1.6

Fixed in

11.1.7

ID

GHSA-m8p5-r7qv-cx4c

Source summary

Summary In the Astro Node adapter, a request whose Host header contains a malformed port (for example example.com:65536 or example.com:8080:8080 ) produced an invalid request URL. The fallback intended to recover from an unparseable URL reused the same malformed host, so it failed again and raised an uncaught TypeError: Invalid URL while the request was being built, before any route ran. Impact The effect depends on the adapter configuration: - Default configuration ( standalone ): the request returns 500 Internal Server Error and the server continues running. - With the opt-in staticHeaders:

Affected

@astrojs/node <=11.1.2

Fixed in

11.1.3

ID

GHSA-qh8j-hqjv-7m4x