Home / Vulnerability Intelligence / CVE-2026-29772

CVE-2026-29772 - Vulnerability Analysis

MediumCVSS: 5.9

Last Updated: March 25, 2026

Astro - Denial of Service

Published: March 24, 2026Updated: March 25, 2026PoC AvailableRemote Exploitable

Overview

Astro < 10.0.0 contains a denial of service caused by unbounded JSON body parsing in Server Islands POST handler, letting unauthenticated attackers crash the server by exhausting heap memory, exploit requires crafted JSON payload.

Severity & Score

Severity: Medium

CVSS Score: 5.9

Impact

Unauthenticated attackers can crash the server by exhausting heap memory, causing denial of service.

Mitigation

Update to version 10.0.0 or later.

References

https://github.com/withastro/astro/security/advisories/GHSA-3rmj-9m5h-8fpv

Related Resources

Vulnerability Intelligence Dashboard
Credential Scanner

Details

CVE ID: CVE-2026-29772
Severity: Medium
CVSS Score: 5.9
Type: denial_of_service
Status: confirmed

CWE

CWE-770

CVSS Metrics

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H