CVE-2026-41322: 
JavaScript vulnerability analysis and mitigation

CVE-2026-41322 is a cache poisoning vulnerability in the @astrojs/node npm package that allows unauthenticated remote attackers to cause denial of service by poisoning CDN/edge caches with error responses. When a static asset under the _astro path is requested with a malformed or incorrect If-Match header, the server incorrectly returns an HTTP 500 error with a Cache-Control: public, max-age=31536000, immutable header instead of the correct HTTP 412 (Precondition Failed) response without cache headers. This causes downstream CDN caches to serve the 5xx error to all subsequent visitors until the one-year cache TTL expires, effectively making the asset unavailable. All versions of @astrojs/node prior to 10.0.5 are affected. It carries a CVSS v3.1 base score of 5.3 (Medium) (GitHub Advisory).

The root cause is improper error handling in the serve-static module of @astrojs/node (CWE-525: Use of Web Browser Cache Containing Sensitive Information). The send library, used internally to serve static files, processes conditional request headers like If-Match. When a file exists but the ETag precondition fails, send emits a file event (setting forwardError = true), then a headers event (which sets Cache-Control: public, max-age=31536000, immutable on the response), and finally an error event with a PreconditionFailedError (status 412). However, the error handler ignores the error's status code entirely and always responds with HTTP 500, while the Cache-Control header set during the headers event is already attached to the response. The fix requires the error handler to inspect the error status and respond with the appropriate HTTP 412 without cache headers (GitHub Advisory).

Successful exploitation results in cache poisoning at the CDN/edge layer, causing static JavaScript and CSS assets served from the _astro path to be replaced in cache with HTTP 500 error responses for up to one year. This breaks the affected web application for all users routed through the poisoned CDN Point of Presence, as their browsers receive error pages instead of required assets. There is no confidentiality or integrity impact; the impact is limited to availability of the affected static resources (GitHub Advisory).

A proof-of-concept exploit is publicly documented in the GitHub Security Advisory, requiring only a single curl command with a malformed If-Match header (e.g., curl -H "if-match: xxx") targeting a _astro static asset URL. No authentication or special privileges are required. The EPSS score is approximately 0.039% (low probability of widespread exploitation). There is no evidence of active in-the-wild exploitation or CISA KEV catalog listing as of the time of disclosure (GitHub Advisory).

1. Reconnaissance: Identify a target site running @astrojs/node in SSR mode (versions prior to 10.0.5) with a CDN in front. Locate static asset URLs under the /_astro/ path by inspecting the page source or browser developer tools for hashed .js or .css filenames.
2. Craft malicious request: Send an HTTP request to a discovered static asset URL with a deliberately malformed or incorrect If-Match header value (e.g., if-match: xxx) that will not match the asset's ETag.

   curl -s -o /dev/null -D - https://target.example.com/_astro/main.AbCdEfGh.js -H "if-match: xxx"

3. Trigger cache poisoning: The @astrojs/node server responds with HTTP/1.1 500 Internal Server Error and Cache-Control: public, max-age=31536000, immutable. The CDN caches this error response for one year.
4. Observe impact: Subsequent requests to the same asset URL from any user routed through the same CDN Point of Presence receive the cached 500 error instead of the actual file, breaking the web application for all affected users until the cache is manually purged or expires (GitHub Advisory).

• Network: HTTP requests to /_astro/ static asset paths containing an If-Match header with arbitrary or non-ETag-formatted values (e.g., short strings, random text).
• Logs: Server access logs showing HTTP 500 responses for requests to /_astro/*.js or /_astro/*.css paths that include an If-Match request header; repeated 500 responses for the same asset URL from different source IPs.
• CDN/Cache: CDN cache entries for /_astro/ assets returning 5xx status codes with Cache-Control: public, max-age=31536000, immutable headers; CDN error logs referencing upstream 500 responses for static asset paths.
• Application Behavior: End users reporting broken pages (missing styles or scripts) that persist across sessions and are not resolved by browser cache clearing (GitHub Advisory).

Upgrade @astrojs/node to version 10.0.5 or later, which correctly handles PreconditionFailedError by returning HTTP 412 without cache headers. As a short-term workaround prior to patching, operators can configure their CDN to not cache 5xx responses, or add If-Match as a cache key dimension to prevent poisoned responses from being served to other users. Purging the CDN cache for all /_astro/ paths is recommended immediately after upgrading to clear any already-poisoned entries (GitHub Advisory).

The vulnerability was reported by researcher dnlbln and reviewed by Astro maintainers matthewp (remediation reviewer) and ematipico (remediation developer). The advisory was published on April 20, 2026, with the fix released promptly in @astrojs/node@10.0.5. No significant broader media coverage or notable social media discussion has been identified beyond the GitHub advisory and standard vulnerability aggregator listings (GitHub Advisory).