Astro is a JavaScript web framework that uses server actions to process incoming requests. In versions 9.0.0 through 9.5.3, the framework’s Node adapter has no default limit on request body size for server actions. An attacker can send a single oversized POST to an exposed action endpoint, causing the entire request body to be buffered in memory. The unbounded buffer can exhaust the process heap and crash the server, resulting in a denial‑of‑service condition.

The vulnerability affects the Astro web framework (maintained by withastro). All releases from 9.0.0 up to and including 9.5.3 are vulnerable. Version 9.5.4 contains a fix that enforces a request size limit. Users deploying Astro with the Node adapter in standalone mode are at risk, especially in containerised environments where the crashed process is automatically restarted.

The CVSS score is 5.9, indicating moderate severity. EPSS is below 1 %, so the likelihood of exploitation is low, and the issue is not listed in the CISA KEV catalogue. Nonetheless, the lack of authentication on server action endpoints means an unauthenticated attacker can trigger the DoS by simply posting a large request. In containerised deployments, the repeated crash and restart cycle can keep the application unavailable over time.