CVE-2026-27729

{"id": "CVE-2026-27729", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.2}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2026-02-24T01:16:15.700", "references": [{"url": "https://github.com/withastro/astro/commit/522f880b07a4ea7d69a19b5507fb53a5ed6c87f8", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/withastro/astro/pull/15564", "tags": ["Issue Tracking"], "source": "security-advisories@github.com"}, {"url": "https://github.com/withastro/astro/releases/tag/%40astrojs%2Fnode%409.5.4", "tags": ["Product", "Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/withastro/astro/security/advisories/GHSA-jm64-8m5q-4qh8", "tags": ["Exploit", "Third Party Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-770"}]}], "descriptions": [{"lang": "en", "value": "Astro is a web framework. In versions 9.0.0 through 9.5.3, Astro server actions have no default request body size limit, which can lead to memory exhaustion DoS. A single large POST to a valid action endpoint can crash the server process on memory-constrained deployments. On-demand rendered sites built with Astro can define server actions, which automatically parse incoming request bodies (JSON or FormData). The body is buffered entirely into memory with no size limit \u2014 a single oversized request is sufficient to exhaust the process heap and crash the server. Astro's Node adapter (`mode: 'standalone'`) creates an HTTP server with no body size protection. In containerized environments, the crashed process is automatically restarted, and repeated requests cause a persistent crash-restart loop. Action names are discoverable from HTML form attributes on any public page, so no authentication is required. The vulnerability allows unauthenticated denial of service against SSR standalone deployments using server actions. A single oversized request crashes the server process, and repeated requests cause a persistent crash-restart loop in containerized environments. Version 9.5.4 contains a fix."}, {"lang": "es", "value": "Astro es un framework web. En las versiones 9.0.0 a 9.5.3, las acciones del servidor de Astro no tienen un l\u00edmite de tama\u00f1o de cuerpo de solicitud predeterminado, lo que puede llevar a una DoS por agotamiento de memoria. Una \u00fanica solicitud POST grande a un endpoint de acci\u00f3n v\u00e1lido puede colapsar el proceso del servidor en despliegues con restricciones de memoria. Los sitios renderizados bajo demanda construidos con Astro pueden definir acciones de servidor, que analizan autom\u00e1ticamente los cuerpos de las solicitudes entrantes (JSON o FormData). El cuerpo se almacena completamente en la memoria sin l\u00edmite de tama\u00f1o \u2014 una \u00fanica solicitud sobredimensionada es suficiente para agotar el heap del proceso y colapsar el servidor. El adaptador de Node de Astro ('mode: 'standalone'') crea un servidor HTTP sin protecci\u00f3n de tama\u00f1o de cuerpo. En entornos contenerizados, el proceso colapsado se reinicia autom\u00e1ticamente, y las solicitudes repetidas causan un bucle persistente de colapso-reinicio. Los nombres de las acciones son detectables a partir de los atributos de los formularios HTML en cualquier p\u00e1gina p\u00fablica, por lo que no se requiere autenticaci\u00f3n. La vulnerabilidad permite la denegaci\u00f3n de servicio no autenticada contra despliegues SSR standalone que utilizan acciones de servidor. Una \u00fanica solicitud sobredimensionada colapsa el proceso del servidor, y las solicitudes repetidas causan un bucle persistente de colapso-reinicio en entornos contenerizados. La versi\u00f3n 9.5.4 contiene una soluci\u00f3n."}], "lastModified": "2026-02-25T15:19:42.290", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:astro:\\@astrojs\\/node:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "4544AFCE-A719-4079-859C-E356B5871A4C", "versionEndExcluding": "9.5.4", "versionStartIncluding": "9.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}