PT-2026-21611 · Astro · Astro

Pho9Ubenaa · Published 2026-02-24 · Updated 2026-02-26 · CVE-2026-27729

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Astro versions 9.0.0 through 9.5.3

Description Astro server actions lack a default request body size limit, potentially leading to a denial of service (DoS) due to memory exhaustion. A large POST request to a valid action endpoint can crash the server process, particularly on deployments with limited memory. The vulnerability occurs because Astro automatically parses incoming request bodies (JSON or FormData) into memory without any size restrictions. This allows an attacker to send an oversized request, exhausting the process heap and causing the server to crash. In containerized environments, this can result in a persistent crash-restart loop. The vulnerability is exploitable without authentication, as action names are discoverable from HTML form attributes on public pages.

Recommendations Update to Astro version 9.5.4 or later.

Exploit

Fix

DoS

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2026-27729

GHSA-JM64-8M5Q-4QH8

Affected Products

Astro

References · 13

• 🔥 https://github.com/withastro/astro/security/advisories/GHSA-jm64-8m5q-4qh8 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27729.json · Exploit
• https://github.com/withastro/astro/commit/522f880b07a4ea7d69a19b5507fb53a5ed6c87f8 · Patch
• https://osv.dev/vulnerability/CVE-2026-27729 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27729 · Security Note
• https://osv.dev/vulnerability/GHSA-jm64-8m5q-4qh8 · Vendor Advisory
• https://github.com/withastro/astro · Note
• https://github.com/withastro/astro/releases/tag/%40astrojs%2Fnode%409.5.4 · Note
• https://github.com/withastro/astro/pull/15564 · Note
• https://github.com/withastro/astro/releases/tag/@astrojs/node@9.5.4 · Note
• https://twitter.com/CVEnew/status/2026184650104930541 · Twitter Post
• https://twitter.com/_cvereports/status/2026879979275817095 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2026184571427934538 · Twitter Post