The vulnerability arises from Astro's Server Islands POST handler, which buffers and parses the entire request body as JSON without a size restriction. Because JSON.parse allocates a V8 heap object for every element in the input, an attacker can send a crafted payload containing many small JSON objects that amplifies memory consumption roughly fifteen times the amount of raw data. When the payload triggers a heap exhaustion, the Node.js process crashes, denying service. This flaw is represented by CWE‑770 and allows unauthenticated attackers to cause a denial of service by exhausting server memory.

Astro implementations using the Node standalone adapter are affected. The /_server‑islands/[name] route is present on all Astro SSR applications, regardless of whether any component uses server:defer, meaning that any Astro SSR app built with Node adapter and running a version earlier than 10.0.0 falls within the scope. Vendors: withastro:astro. Products: Astro web framework, versions up to 9.x, any SaaS sites or self‑hosted deployments using Node.

The CVSS score is 5.9, indicating a medium severity. EPSS is below 1%, suggesting that known exploitation probability is low, and the vulnerability is not listed in the CISA KEV catalog. Attackers can trigger the flaw by sending an unauthenticated HTTP POST request to the /_server‑islands endpoint with a large JSON payload. The attack requires no special credentials and bypasses validation checks because the body is parsed before the island name is validated. Therefore, protecting the service by patching or limiting request size is essential to mitigate the risk.