Astro builds an internal request URL from the value of the Host header. A malformed port within that header can cause the URL construction to fail, raising an uncaught TypeError that propagates before routing begins. When the adapter runs in its default standalone mode the server responds with an HTTP 500 error but remains operational; however, when the staticHeaders feature is active the synchronous handler does not catch the exception, resulting in the entire Node process terminating. The flaw does not leak confidential data or allow execution of arbitrary code, but it can be used to cripple web services—an availability attack consistent with the CWE‑248 weakness of unexpected or invalid input handling.

The vulnerability afflicts the Astro web framework, specifically the @astrojs/node adapter distributed under the withastro:astro vendor. Affected are all releases prior to version 11.1.3. Users running these versions with staticHeaders enabled are at risk of process termination, while users without that feature only experience transient 500 responses.

The CVSS score of 8.2 indicates a high severity impact. EPSS data is not available, and the issue is not listed in the CISA KEV catalog, suggesting no publicly known widespread exploitation yet. Attackers can trigger the crash by sending an HTTP request whose Host header contains an invalid port number, a technique that may be filtered by some proxies or CDNs if they enforce strict header validation. Still, any path that reaches an unpatched Astro instance can cause a denial of service by terminating the Node process. The zero‑knowledge requirement for code execution means the risk is confined to availability, but the impact on production services can be significant.