{"id":"CVE-2026-54299","aliases":["GHSA-2pvr-wf23-7pc7"],"title":"Astro: Host header SSRF in prerendered error page fetch","summary":"Astro: Host header SSRF in prerendered error page fetch","severity":"high","cvss":7.5,"cwe":["CWE-20","CWE-918"],"vendor":"astro","product":"astro","ecosystem":"npm","affected":["astro < 6.4.6"],"patched":["astro 6.4.6"],"published":"2026-06-16","updated":"2026-06-16","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-2pvr-wf23-7pc7","references":[{"url":"https://github.com/withastro/astro/security/advisories/GHSA-2pvr-wf23-7pc7"},{"url":"https://github.com/advisories/GHSA-2pvr-wf23-7pc7"}],"tags":["ghsa","npm"],"epss":0.00333,"epssPercentile":0.26686,"ingestedAt":"2026-07-07T15:41:58.339Z","slug":"CVE-2026-54299","body":"## Overview\n\n## Summary\n\nAstro SSR apps with prerendered error pages (`/404` or `/500` using `export const prerender = true`) fetch those pages over HTTP at runtime when an error occurs. The URL for this fetch is derived from `request.url`, which in turn gets its origin from the incoming `Host` header. When the `Host` header is not validated against `allowedDomains`, an attacker can point the fetch at an arbitrary host and read the response.\n\n## Who is affected\n\nThis affects SSR deployments that:\n\n1. Have a prerendered 404 or 500 page\n2. Use `createRequestFromNodeRequest` from `astro/app/node` with `app.render()` **without** overriding `prerenderedErrorPageFetch` — this includes custom servers built on the public API and third-party adapters\n\n**Not affected:**\n- `@astrojs/node` >= 9.5.4 (reads error pages from disk)\n- `@astrojs/cloudflare` (uses the ASSETS binding)\n- The dev server (renders error pages in-process)\n\n## How it works\n\n`createRequestFromNodeRequest` builds `request.url` from the raw `Host` / `:authority` header. The `allowedDomains` option is accepted but only gates `X-Forwarded-For` — it does not constrain the URL origin. (The public `createRequest` does fall back to `localhost` for unvalidated hosts; this internal builder did not.)\n\nWhen `app.render()` encounters a 404 or 500 with a prerendered error route, `default-handler.ts` constructs the error page URL using the origin from `request.url` and fetches it via `prerenderedErrorPageFetch`, which defaults to global `fetch`. The response body is served to the client.\n\nAn attacker sends a request with `Host: attacker-host:port`, triggers an error (e.g., requesting a nonexistent path for a 404), and receives the response from the attacker-controlled host reflected back.\n\n## Remediation\n\nThe error page fetch origin is now validated against `allowedDomains` before use. When the host is validated, the original origin is preserved. Otherwise, it falls back to `localhost`. The fetch is also wrapped in a try/catch so that connection failures degrade gracefully to a plain error response.\n\n## Credit\n\n5ud0 / Tarmo Technologies\n\n## Affected packages\n\n- `astro < 6.4.6`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `astro 6.4.6`","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}