Source summary

Summary In the Astro Node adapter, a request whose Host header contains a malformed port (for example example.com:65536 or example.com:8080:8080 ) produced an invalid request URL. The fallback intended to recover from an unparseable URL reused the same malformed host, so it failed again and raised an uncaught TypeError: Invalid URL while the request was being built, before any route ran. Impact The effect depends on the adapter configuration: - Default configuration ( standalone ): the request returns 500 Internal Server Error and the server continues running. - With the opt-in staticHeaders:

Affected

@astrojs/node <=11.1.2

Fixed in

11.1.3

ID

GHSA-qh8j-hqjv-7m4x

Source summary

Root cause astro/app/node exports two request builders with opposite security postures: - createRequest() (line 123) validates the Host header against security.allowedDomains and falls back to localhost when it does not match, with the comment "Otherwise, fall back to 'localhost' to prevent SSRF attacks." - createRequestFromNodeRequest() (line 51) takes req.headers.host verbatim as the URL authority. No validation of any kind. @astrojs/node uses the unvalidated one on every request, in both serving modes: packages/integrations/node/src/serve-app.ts:99 createRequestFromNodeRequest(req, {...}) p

Affected

@astrojs/node <=11.1.6

Fixed in

11.1.7

ID

GHSA-m8p5-r7qv-cx4c

Source summary

Summary Astro's JSX and MDX rendering pipeline treated string children of , an attacker-controlled value containing or could terminate the element and inject arbitrary HTML and JavaScript. Other JSX expression contexts escaped dynamic strings automatically. This behavior was limited to passed to was emitted without escaping. The browser interpreted the first closing tag as markup and executed the injected script. The fix preserves raw rendering for literal script and style content while escaping dynamic string children like other JSX expression values. Impact Affected applications could be vul

Affected

astro <7.3.2

Fixed in

7.3.2

ID

GHSA-98hj-9722-w3j8

Source summary

Summary Astro's server-side View Transition CSS generator did not keep string animation properties within their generated CSS declarations. In an application that passes attacker-controlled data into an animation property such as duration , a value containing CSS delimiters could terminate the declaration and rule, then add attacker-selected CSS to the server-rendered page. The injected content remains inside the generated element. It cannot terminate that element or inject HTML or JavaScript because Astro escapes element. CSS delimiters such as ; , { , and } remained active, allowing a value

Affected

astro >=7.1.0 <=7.3.2

Fixed in

7.3.3

ID

GHSA-mpr7-6m5w-76rw