CVE-2026-41322 — @astrojs/node allows Astro to deploy your SSR site to Node

title: Exploit of CVE-2026-41322: Malformed If-Match Header for _astro Resources
id: scw-2026-04-24-ai-1
status: experimental
level: medium
description: |
  This rule detects requests to '/_astro/' resources with a GET method that result in a 500 Internal Server Error. This specific behavior, triggered by a malformed 'If-Match' header, is characteristic of the CVE-2026-41322 vulnerability in @astrojs/node, leading to a prolonged cache poisoning effect.
author: SCW Feed Engine (AI-generated)
date: 2026-04-24
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-41322/
tags:
  - attack.initial_access
  - attack.t1190
logsource:
    category: webserver
detection:
  selection:
      cs-uri|contains:
          - '/_astro/'
      cs-method:
          - 'GET'
      sc-status:
          - '500'
      # This condition is difficult to directly map to a single log field, 
      # but the combination of URI path, method, and status code is indicative.
      # A more robust detection might involve correlating with specific request headers if available.
      condition: selection
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse