CVE-2026-102984

Executive Summary

CVE-2026-102984 is an uncaught exception vulnerability in the @astrojs/node adapter of the Astro web framework, affecting versions prior to 11.1.3. The adapter constructs a request URL from the HTTP Host header, and a malformed port within that header produces an invalid URL, triggering an uncaught TypeError: Invalid URL before routing begins. Impact is availability-only: in the default standalone configuration the request returns HTTP 500 while the server survives, but when staticHeaders is enabled the synchronous handler fails to catch the exception and the Node process terminates, causing a full denial of service. The flaw does not expose data or permit code execution, and no public PoC, Nuclei template, or exploit code is currently available.

Technical Analysis

The vulnerability resides in URL construction logic inside the @astrojs/node adapter. According to the NVD description, the adapter "builds a request URL from the Host header," meaning the server derives the effective request URL partly from a client-supplied value rather than exclusively from trusted server-side configuration. When the Host header contains a malformed port component, the concatenated string cannot be parsed as a valid URL and the URL parser throws TypeError: Invalid URL.

Two failure behaviors are described:

1. Default standalone configuration: The exception occurs before routing begins. The request returns an HTTP 500 response, and the server process continues running. This is a per-request failure — an availability degradation, not a full outage, because the Node process remains alive to serve subsequent requests.

2. staticHeaders enabled: The synchronous handler that processes the request does not catch the exception. Because the throw is unhandled within that synchronous path, it propagates to the Node.js process level, and the Node process terminates. Restarting requires external supervision (e.g., a process manager or orchestrator), and each new malformed request can re-trigger the crash, creating a repeatable denial-of-service condition.

The root cause maps to CWE-248 (Uncaught Exception). The recovery path, per the description, "reuses the same malformed host" — that is, the error-handling attempt does not sanitize or substitute the offending Host value, so it throws again rather than gracefully degrading. The exception surfaces before routing, so no application route handler, middleware, or framework-level error boundary intercepts it in the staticHeaders path.

The attack surface is the HTTP listener exposed by the Node adapter. The relevant input is the Host request header. The vulnerability requires no authentication and no user interaction; it is triggered purely by the shape of an inbound request. Proxies and CDNs that validate or reject malformed Host headers prevent the malicious request from reaching the origin, which is a meaningful environmental mitigant but not a fix.

The issue is explicitly scoped: "availability only and does not expose data or permit code execution." There is no memory corruption, no injection into a query or command interpreter, and no path to reading, modifying, or exfiltrating data.

Exploitation Scenarios

No public proof-of-concept exists. The following attack chain is inferred from the vulnerability class (CWE-248, uncaught exception triggered by malformed input) and the mechanics stated in the NVD description. Specific header values, port formats, or code symbols beyond those named in the description are not asserted here.

1. Reconnaissance / target identification. An adversary identifies an internet-facing or internal service running the Astro @astrojs/node adapter at a version prior to 11.1.3. Fingerprinting may rely on Astro-specific HTTP response characteristics. Critically, the attacker must determine whether the origin is directly reachable or shielded by a proxy/CDN, because "proxies and CDNs that reject malformed Host headers prevent this path from reaching the origin." Direct-to-origin exposure (common for internal apps, staging environments, or un-fronted deployments) is the favorable condition.

2. Triggering the flaw class. The attacker sends an HTTP request whose Host header contains a malformed port component. Per the description, this causes the adapter's request URL construction to produce an invalid URL, and the parser throws TypeError: Invalid URL. No payload, code injection, or authentication is involved — the malformed header value itself is the trigger.

3. Execution / impact realization. Behavior depends on deployment configuration:

   • Default standalone: the request yields HTTP 500; the server keeps running. The attacker observes the error response as confirmation the path is reachable.
   • staticHeaders enabled: the exception escapes the synchronous handler uncaught, and the Node process terminates. The attacker confirms success by observing connection failure or loss of service.

4. Post-exploitation impact. If the process crash is confirmed, the attacker can repeat malformed requests to sustain the denial of service, depending on how quickly the process supervisor restarts the service. There is no data exposure, no lateral movement enabled by this flaw itself, and no remote code execution. The objective is purely availability disruption. Where a proxy/CDN rejects the malformed header, the attack does not reach the origin and fails.

Impact Assessment

The impact is confined to availability, consistent with a CWE-248 uncaught-exception class and the explicit NVD statement that the issue "affects availability only."

• Confidentiality: None. The description states the flaw "does not expose data."
• Integrity: None. No data or configuration modification is described.
• Availability: High in the staticHeaders configuration, where the Node process terminates; moderate in the default standalone configuration, where individual requests fail with HTTP 500 while the service remains up.

The blast radius is determined by deployment topology and process supervision:

• Directly exposed origins running the affected @astrojs/node adapter are most at risk, especially those with staticHeaders enabled, since a single crafted request can kill the process.
• CDN- or proxy-fronted deployments that reject malformed Host headers are substantially shielded, because the request never reaches the origin.
• Multi-tenant or shared Node processes would see all tenants served by that process affected by a crash, amplifying the availability impact beyond a single application.
• Auto-scaling or restart-on-crash environments may mask the crash behind brief recovery windows, but repeated requests can produce sustained flapping, elevated restart churn, and degraded capacity.

Because no CVSS score or vector was assigned in the provided data, no numeric base score is cited here. Based on the described characteristics (network-reachable, low complexity, no privileges, no user interaction, availability-only), the dominant impact metric would be Availability, but this is stated as an inference from the description rather than an official score.

Detection Guidance

Sigma Rule

title: Astro @astrojs/node Malformed Host Header Denial of Service
id: 6b1f2c9a-4d3e-4a7c-9f21-08c7a5e2d3b1
status: experimental
description: Detects HTTP requests with malformed port in the Host header targeting Astro applications using the @astrojs/node adapter, which can trigger an uncaught Invalid URL TypeError (CVE-2026-102984).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-102984
author: valtersit.com
date: 2026-01-01
logsource:
  category: webserver
detection:
  selection_method:
    cs-method:
      - GET
      - POST
      - HEAD
      - PUT
      - DELETE
  selection_malformed_host:
    cs-host|re: '^(?:[a-zA-Z0-9\.\-]+)?:(?!\d{1,5}$).*$|^.*:\d{6,}.*$|^.*:[^0-9].*$'
  condition: selection_method and selection_malformed_host
fields:
  - c-ip
  - cs-host
  - cs-uri-stem
  - sc-status
falsepositives:
  - Legitimate malformed Host headers from misconfigured clients or scanners
level: medium
tags:
  - attack.t1190
  - cve.2026.102984

YARA Rule

rule CVE_2026_102984_Astro_Node_Adapter
{
    meta:
        description = "Detects Astro @astrojs/node adapter artifacts associated with CVE-2026-102984 (invalid URL handling in request URL construction)"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-102984"
        cve = "CVE-2026-102984"

    strings:
        $adapter = "@astrojs/node" ascii wide nocase
        $static = "staticHeaders" ascii wide nocase
        $err1 = "Invalid URL" ascii wide
        $err2 = "TypeError" ascii wide
        $host1 = "host" ascii wide nocase

    condition:
        uint16(0) == 0x5A4D or uint32(0) == 0x464C457F or true
        and $adapter
        and $static
        and (1 of ($err*))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-102984 Astro @astrojs/node Malformed Host Header Denial of Service Attempt"; flow:established,to_server; http.header; content:"Host|3A|"; nocase; pcre:"/Host\x3a\s*[^\r\n]*:\d{6,}/i"; reference:cve,2026-102984; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-102984; classtype:attempted-dos; sid:2026102984; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=10s
  [ network where network.protocol == "http" and
      http.request.method in ("GET", "POST", "HEAD", "PUT", "DELETE") and
      /* malformed port in Host header: non-numeric or out-of-range port */
      http.request.headers.Host regex~ ".*:[^0-9].*|.*:[0-9]{6,}.*" ]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=access_common
| eval host_value = coalesce(host_header, cs_Host, http_host)
| where match(host_value, ":\D") OR match(host_value, ":\d{6,}")
| stats count min(_time) as first_seen max(_time) as last_seen values(status) as status_codes values(uri) as uris by src_ip host_value
| where count > 5
| sort - count
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

<group name="web,astro,cve-2026-102984,">
  <rule id="2026102" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <field name="host">\.\d{6,}</field>
    <description>CVE-2026-102984: Malformed Host header with invalid port sent to Astro @astrojs/node adapter (possible DoS attempt)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>attack_availability,</group>
  </rule>

  <rule id="2026103" level="12">
    <if_matched_sid>2026102</if_matched_sid>
    <same_source_ip />
    <frequency>10</frequency>
    <timeframe>60</timeframe>
    <description>CVE-2026-102984: Repeated malformed Host headers from same source (sustained DoS attempt against Astro @astrojs/node)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or affected-version list was provided by the tracked sources. The NVD description states the issue is fixed in version 11.1.3; treat that as the target version but validate patch availability against the vendor's own release channels before relying on it, given the 0/4 confidence rating.

1) Immediate mitigations

• Deploy the origin behind a proxy, load balancer, or CDN that validates Host headers and rejects malformed port components. The NVD description explicitly notes that such intermediaries prevent this path from reaching the origin.
• If staticHeaders is not operationally required, disable it to reduce the crash condition from process termination to an HTTP 500 per malformed request.
• Run the Node process under a supervisor (systemd, PM2, Kubernetes with restart policy) so that any process termination is automatically recovered, limiting outage duration.
• Apply rate limiting at the edge to slow repeated malformed-request floods.
• Restrict direct-to-origin access (firewall/security-group rules) so only the trusted proxy can reach the adapter listener.

2) Patch / upgrade steps

• Target Astro version 11.1.3 or later, which the description identifies as containing the fix for the @astrojs/node adapter.
• Upgrade the framework and the @astrojs/node adapter together; validate that the adapter version pulled matches the fixed release.
• Rebuild and redeploy; confirm the deployed version at runtime.
• After upgrading, re-test with malformed Host headers in both default and staticHeaders configurations to confirm no uncaught exception and no process termination.

3) Long-term hardening

• Treat the Host header as untrusted input in all server-side URL construction; validate and normalize it against an allowlist of expected hostnames and port ranges.
• Wrap request-handling entry points, especially synchronous adapter paths, in top-level exception handlers so unexpected throws degrade to controlled HTTP error responses instead of process termination.
• Add regression tests that feed malformed Host values (invalid and out-of-range ports) through the adapter to catch reintroductions.
• Monitor restart counts and 500-rate spikes as availability signals, with alerting on abnormal process churn.

References

• NVD — CVE-2026-102984: https://nvd.nist.gov/vuln/detail/CVE-2026-102984
• MITRE CWE-248 — Uncaught Exception: https://cwe.mitre.org/data/definitions/248.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• Astro project repository and release notes for the @astrojs/node adapter (verify version 11.1.3 fix): https://github.com/withastro/astro

No CISA KEV listing, no known threat actor campaign, and no exploit-in-the-wild evidence were provided in the source data. PoC status: None. Nuclei template: No. Exploit code: No.