{"id":"EUVD-2026-25580","enisaUuid":"08474da4-57a5-3308-b5f4-17ef02244c60","description":"@astrojs/node allows Astro to deploy your SSR site to Node targets. Prior to 10.0.5, requesting a static js/css resources from _astro path with an incorrect/malformed if-match header returns a 500 error with a one year cache lifetime instead of 412 in some cases. This has the effect that all subsequent requests to that file, regardless of if-match header will be served a 5xx error instead of the file until the cache expires. This vulnerability is fixed in 10.0.5.","datePublished":"Apr 24, 2026, 5:08:13 PM","dateUpdated":"Apr 25, 2026, 1:48:27 AM","baseScore":5.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","references":"https://github.com/withastro/astro/security/advisories/GHSA-c57f-mm3j-27q9\n","aliases":"CVE-2026-41322\nGHSA-c57f-mm3j-27q9\n","assigner":"GitHub_M","epss":0.24,"enisaIdProduct":[{"id":"fc16e8ba-6616-39ed-a2ce-5868198452e5","product":{"name":"astro","vendor":{"name":"withastro"}},"product_version":"\u003c 10.0.5"}],"enisaIdVendor":[{"id":"da1dc50a-08b6-36fa-b98d-e76906ef3604","vendor":{"name":"withastro"}}],"enisaIdVulnerability":[{"id":"54892f5d-b0fd-3d63-b2b7-541152d575ef","vulnerability":{"id":"GHSA-c57f-mm3j-27q9","description":"Astro: Cache Poisoning due to incorrect error handling when if-match header is malformed ","datePublished":"Apr 23, 2026, 2:36:03 PM","dateUpdated":"Apr 27, 2026, 4:42:14 PM","baseScore":0.0,"references":"https://github.com/withastro/astro/security/advisories/GHSA-c57f-mm3j-27q9\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-41322\nhttps://github.com/withastro/astro\n","enisa_id":"EUVD-2026-25580\n","aliases":"GHSA-c57f-mm3j-27q9\nCVE-2026-41322\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:55:10 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"84a75874-82ad-3005-aa06-7dc032f7e20e","vulnerability":{"id":"CVE-2026-41322","description":"@astrojs/node allows Astro to deploy your SSR site to Node targets. Prior to 10.0.5, requesting a static js/css resources from _astro path with an incorrect/malformed if-match header returns a 500 error with a one year cache lifetime instead of 412 in some cases. This has the effect that all subsequent requests to that file, regardless of if-match header will be served a 5xx error instead of the file until the cache expires. This vulnerability is fixed in 10.0.5.","datePublished":"Apr 24, 2026, 5:08:13 PM","dateUpdated":"Apr 25, 2026, 1:48:27 AM","status":"PUBLISHED","baseScore":5.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","references":"https://github.com/withastro/astro/security/advisories/GHSA-c57f-mm3j-27q9\n","enisa_id":"EUVD-2026-25580\n","assigner":"GitHub_M","epss":0.24,"dataProcessed":"Oct 27, 2026, 7:17:29 AM","vulnerabilityProduct":[{"id":"20cd8464-9d41-33e8-9645-e18b9c4d21b0","product":{"name":"astro","vendor":{"name":"withastro"}},"product_version":"\u003c 10.0.5"}],"vulnerabilityVendor":[{"id":"5b00b85c-2892-3e00-90c0-beb10ed1ad9a","vendor":{"name":"withastro"}}]}}],"enisaIdAdvisory":[]}