https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 02:18:25 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-293001 EUVD-2026-293001 https://cve.radiocsirt.org/vuln/euvd-2026-293001 https://cve.radiocsirt.org/vuln/fkie_cve-2026-41322 <p>@astrojs/node allows Astro to deploy your SSR site to Node targets. Prior to 10.0.5, requesting a static js/css resources from _astro path with an incorrect/malformed if-match header returns a 500 error with a one year cache lifetime instead of 412 in some cases. This has the effect that all subsequent requests to that file, regardless of if-match header will be served a 5xx error instead of the file until the cache expires. This vulnerability is fixed in 10.0.5.</p> <p>@astrojs/node allows Astro to deploy your SSR site to Node targets. Prior to 10.0.5, requesting a static js/css resources from _astro path with an incorrect/malformed if-match header returns a 500 error with a one year cache lifetime instead of 412 in some cases. This has the effect that all subsequent requests to that file, regardless of if-match header will be served a 5xx error instead of the file until the cache expires. This vulnerability is fixed in 10.0.5.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-41322 https://cve.radiocsirt.org/vuln/ghsa-c57f-mm3j-27q9 <p><strong>Affected:</strong> npm: @astrojs/node</p> <p>### Summary Requesting a static JS/CSS resource from the `_astro` path with an incorrect or malformed `if-match` header returns a `500` error with a one-year cache lifetime instead of `412` in some cases. As a result, all subsequent requests to that file — regardless of the `if-match` header — will be served a 5xx error instead of the file until the cache expires.</p> <p>Sending an incorrect or malformed `if-match` header should always return a `412` error without any cache headers, which is not the current behavior.</p> <p>### Affected Versions - `astro@5.14.1` - `@astrojs/node@9.4.4`</p> <p>### Proof of Concept</p> <p>Run the following command:</p> <p>``` curl -s -o /dev/null -D - &lt;host location&gt;/_astro/_slug_.UTbyeVfw.css -H &#34;if-match: xxx&#34; ```</p> <p>If a 5xx error is not returned, inspect the resources via the browser&#39;s web inspector and select another CSS/JS file to request until a 5xx error is returned. The behavior generally defaults to a 5xx response. Note that all static files are immutable, so the cache must be purged or disabled to reproduce reliably.</p> <p>A response similar to the following is expected from CloudFront:</p> <p>``` HTTP/2 500 content-type: text/html content-length: 166541 date: Thu, 09 Apr 2026 12:53:08 GMT last-modified: Wed, 21 Jan 2026 13:40:08 GMT etag: &#34;a68349e96c2faf8861c330aeb548441a&#34; x-amz-server-side-encryption: AES256 accept-ranges: bytes server: AmazonS3 x-cache: Error from cloudfront via: 1.1 3591be88662e5675a9dc1cc4e0a9c392.cloudfront.net (CloudFront) x-amz-cf-pop: ZRH55-P2 x-am…</p> <p><strong>Affected:</strong> npm: @astrojs/node</p> <p>### Summary Requesting a static JS/CSS resource from the `_astro` path with an incorrect or malformed `if-match` header returns a `500` error with a one-year cache lifetime instead of `412` in some cases. As a result, all subsequent requests to that file — regardless of the `if-match` header — will be served a 5xx error instead of the file until the cache expires.</p> <p>Sending an incorrect or malformed `if-match` header should always return a `412` error without any cache headers, which is not the current behavior.</p> <p>### Affected Versions - `astro@5.14.1` - `@astrojs/node@9.4.4`</p> <p>### Proof of Concept</p> <p>Run the following command:</p> <p>``` curl -s -o /dev/null -D - &lt;host location&gt;/_astro/_slug_.UTbyeVfw.css -H &#34;if-match: xxx&#34; ```</p> <p>If a 5xx error is not returned, inspect the resources via the browser&#39;s web inspector and select another CSS/JS file to request until a 5xx error is returned. The behavior generally defaults to a 5xx response. Note that all static files are immutable, so the cache must be purged or disabled to reproduce reliably.</p> <p>A response similar to the following is expected from CloudFront:</p> <p>``` HTTP/2 500 content-type: text/html content-length: 166541 date: Thu, 09 Apr 2026 12:53:08 GMT last-modified: Wed, 21 Jan 2026 13:40:08 GMT etag: &#34;a68349e96c2faf8861c330aeb548441a&#34; x-amz-server-side-encryption: AES256 accept-ranges: bytes server: AmazonS3 x-cache: Error from cloudfront via: 1.1 3591be88662e5675a9dc1cc4e0a9c392.cloudfront.net (CloudFront) x-amz-cf-pop: ZRH55-P2 x-am…</p> https://cve.radiocsirt.org/vuln/ghsa-c57f-mm3j-27q9