CVE-2026-41322
Medium
Description
@astrojs/node allows Astro to deploy your SSR site to Node targets. Prior to 10.0.5, requesting a static js/css resources from _astro path with an incorrect/malformed if-match header returns a 500 error with a one year cache lifetime instead of 412 in some cases. This has the effect that all subsequent requests to that file, regardless of if-match header will be served a 5xx error instead of the file until the cache expires. This vulnerability is fixed in 10.0.5.
SeverityMedium
CVSS5.3
Exploit probability—
Product@astrojs/node
PublishedApr 24, 2026
First seenApr 24, 2026
Weakness typeCWE-525CWE-525
How to fix
Update
- @astrojs/node10.0.5 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| @astrojs/nodenpm | v < 10.0.5 | 10.0.5 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.