CVE-2026-41322

FAUCET Score

@astrojs/node allows Astro to deploy your SSR site to Node targets. Prior to 10.0.5, requesting a static js/css resources from _astro path with an incorrect/malformed if-match header returns a 500 error with a one year cache lifetime instead of 412 in some cases. This has the effect that all subsequent requests to that file, regardless of if-match header will be served a 5xx error instead of the file until the cache expires. This vulnerability is fixed in 10.0.5.

First published: Apr 24, 2026Last modified: Apr 25, 2026

Impacted Technologies

Vendor	Product	Version(s)	CPE
Withastro	Astro	< 10.0.5CNA affected

CVSS Data

CVSS version used by this source: 3.1

5.3MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

Exploitability Score

3.9

Impact Score

1.4

CvssVersion

3.1

Exploit Intelligence

EPSS Score

0.24%

Probability of exploitation in next 30 days

EPSS Percentile

14.9%

Percentile rank of EPSS score among Peer Group

As of 2026-07-27

Model: v2026.06.15

This CVE's current EPSS score of 0.0024 is in the 6th percentile among its peer group of 23,703 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.4 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (1)

npmpatch availablevia ghsa

Product: @astrojs/nodeFixed in: 10.0.5

Vendor Advisories (1)

npmGHSA-c57f-mm3j-27q9medium

Astro: Cache Poisoning due to incorrect error handling when if-match header is malformed

Apr 23, 2026

References

github.com / withastro/astro/security/advisories/GHSA-c57f-mm3j-27q9