vulnerability · Wed 30 Sep 2026 · 23:29 UTC
GHSA-qh8j-hqjv-7m4x: Astro: Malformed port in the Host header can crash the Node adapter
Filed UTCSource GTH ↗
In the Astro Node adapter, a request whose Host header contains a malformed port (for example example.com:65536 or example.com:8080:8080) produced an invalid request URL. The fallback intended to recover from an unparseable URL reused the same malformed host, so it failed again and raised an uncaught TypeError: Invalid URL while the request was being built, before any route ran. ## Impact The effect depends on the adapter configuration: - Default configuration (standalone): the request returns 500 Internal Server Error and the server continues running. …
Signals
as the pipeline stamped them- High
- High-risk vulnerability
CVE
KEV from CISA · EPSS from FIRST| Id | KEV | EPSS | Reference |
|---|---|---|---|
| CVE-2026-102984 | — | 0.36% | NVD ↗ |
Indicators
checking abuse.ch ThreatFoxChecking indicators against ThreatFox…
Get the next one first.
Every dispatch goes to Telegram and RSS the moment it is published, and the whole wire is a keyless JSON API.
Check your stack
Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.
Stack checkNo key. No signup.