CVE-2026-41322 - @astrojs/node: Cache Poisoning due to incorrect error handling when if-match header is malformed

Back Back to CVE browser

MEDIUM

@astrojs/node: Cache Poisoning due to incorrect error handling when if-match header is malformed

Published Apr 24, 2026

5.3

MEDIUM

CVSS 3.1

EPSS 0.40%

Description

@astrojs/node allows Astro to deploy your SSR site to Node targets. Prior to 10.0.5, requesting a static js/css resources from _astro path with an incorrect/malformed if-match header returns a 500 error with a one year cache lifetime instead of 412 in some cases. This has the effect that all subsequent requests to that file, regardless of if-match header will be served a 5xx error instead of the file until the cache expires. This vulnerability is fixed in 10.0.5.

Affected products

Vendor Withastro Product Astro Default
n/a
- Version
  < 10.0.5
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Withastro

Astro

n/a

Version	Status	Constraints
< 10.0.5	affected	-

Ecosystem	Package	Introduced	Fixed
npm	@astrojs/node	0	10.0.5

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-525

References (4)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-25580
Advisory
https://github.com/advisories/GHSA-c57f-mm3j-27q9
Advisory
https://github.com/withastro/astro/security/advisories/GHSA-c57f-mm3j-27q9
exploitx_refsource_CONFIRM
https://nvd.nist.gov/vuln/detail/CVE-2026-41322

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-25580		Advisory
https://github.com/advisories/GHSA-c57f-mm3j-27q9		Advisory
https://github.com/withastro/astro/security/advisories/GHSA-c57f-mm3j-27q9		exploitx_refsource_CONFIRM
https://nvd.nist.gov/vuln/detail/CVE-2026-41322