CVE-2026-41322

{
  "id": "CVE-2026-41322",
  "sourceIdentifier": "[email protected]",
  "published": "2026-04-24T18:16:28.923",
  "lastModified": "2026-10-26T21:10:00.170",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "@astrojs/node allows Astro to deploy your SSR site to Node targets. Prior to 10.0.5, requesting a static js/css resources from _astro path with an incorrect/malformed if-match header returns a 500 error with a one year cache lifetime instead of 412 in some cases. This has the effect that all subsequent requests to that file, regardless of if-match header will be served a 5xx error instead of the file until the cache expires. This vulnerability is fixed in 10.0.5."
    },
    {
      "lang": "es",
      "value": "@astrojs/node permite a Astro desplegar su sitio SSR a destinos Node. Previo a 10.0.5, solicitar recursos estáticos js/css desde la ruta _astro con una cabecera if-match incorrecta/malformada devuelve un error 500 con una vida útil de caché de un año en lugar de 412 en algunos casos. Esto tiene el efecto de que todas las solicitudes posteriores a ese archivo, independientemente de la cabecera if-match, recibirán un error 5xx en lugar del archivo hasta que la caché expire. Esta vulnerabilidad está corregida en 10.0.5."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "withastro",
          "product": "astro",
          "versions": [
            {
              "version": "< 10.0.5",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "LOW"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-04-25T01:48:09.909604Z",
          "id": "CVE-2026-41322",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-525"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/withastro/astro/security/advisories/GHSA-c57f-mm3j-27q9",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/withastro/astro/security/advisories/GHSA-c57f-mm3j-27q9",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}