@astrojs/node vulnerabilities
Deploy your site to a Node.js server
- Registry
- npm
- Latest
- 11.1.9
- License
- MIT
9 known advisories
The latest version, 11.1.9, is not affected by any of them. Projects on older versions may be.
npm install @astrojs/node@11.1.9Security advisories for @astrojs/node
Astro: Malformed port in the Host header can crash the Node adapter
- Affected
- <11.1.3
- Fixed in
- 11.1.3
@astrojs/node: Backslash-prefixed paths not recognized as internal by trailing-slash redirect
- Affected
- >=8.1.0 <11.0.2
- Fixed in
- 11.0.2
Astro: Cache Poisoning due to incorrect error handling when if-match header is malformed
- Affected
- <10.0.5
- Fixed in
- 10.0.5
Astro: Memory exhaustion DoS due to missing request body size limit in Server Islands
- Affected
- <10.0.0
- Fixed in
- 10.0.0
Astro has memory exhaustion DoS due to missing request body size limit in Server Actions
- Affected
- >=9.0.0 <9.5.4
- Fixed in
- 9.5.4
Astro is vulnerable to SSRF due to missing allowlist enforcement in remote image inferSize
- Affected
- >=9.0.0 <9.5.4
- Fixed in
- 9.5.4
Astro has Full-Read SSRF in error rendering via Host: header injection
- Affected
- <9.5.4
- Fixed in
- 9.5.4
Astro allows unauthorized third-party images in _image endpoint
- Affected
- <9.1.1
- Fixed in
- 9.1.1
@astrojs/node's trailing slash handling causes open redirect issue
- Affected
- <9.4.1
- Fixed in
- 9.4.1
Which of your client projects still run an old @astrojs/node?
NPMscan reads the package-lock.json, yarn.lock and pnpm-lock.yaml in every GitHub repo you pick and checks each installed version against these advisories, including the packages your packages pull in. Each finding comes with the command that fixes it.
Other npm packages
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily. Package details from the npm registry.