SCA: security update for @astrojs/node (GHSA-3rmj-9m5h-8fpv)

high Tenable Self-Hosted Container Security Plugin ID 439181

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

- Astro is a web framework. Prior to version 10.0.0, Astro's Server Islands POST handler buffers and parses
the full request body as JSON without enforcing a size limit. Because JSON.parse() allocates a V8 heap
object for every element in the input, a crafted payload of many small JSON objects achieves ~15x memory
amplification (wire bytes to heap bytes), allowing a single unauthenticated request to exhaust the process
heap and crash the server. The /_server-islands/[name] route is registered on all Astro SSR apps
regardless of whether any component uses server:defer, and the body is parsed before the island name is
validated, so any Astro SSR app with the Node standalone adapter is affected. This issue has been patched
in version 10.0.0. (CVE-2026-29772)

Solution

Update the @astrojs/node library and its related packages to version 10.0.0 or later.

Plugin Details

Severity: High

ID: 439181

Version: Revision 1.7

Type: Local

Family: SCA Checks

Published: 3/25/2026

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.73

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 6.1

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS Score Source: CVE-2026-29772

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.7

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 3/24/2026

Vulnerability Publication Date: 3/24/2026

Reference Information

CVE: CVE-2026-29772

cwe: CWE-770

Detections

Analytics