Astro cache advisory review (2026-10-03)

Source snapshot: public main at 79f7e4ea8324ed616d83c04715a1eaf4dd175144. Review ran in an isolated macOS clone with Node.js 25.9.0 and npm; this is a dependency/source review, not a deployed attack test. No release dependency was changed.

Dependency and affected surface

npm explain http-cache-semantics resolves astro@7.3.5 -> http-cache-semantics@4.2.0. The root lockfile marks this path dev: true; the package declares Astro as an optional peer, not a hard runtime dependency. E02's site-before lockfile and generated project's package template explicitly use Astro 7.3.5. In the isolated clone, npm audit --omit=dev --json found zero root production vulnerabilities, while the full root audit reported two high findings and the E02 baseline audit reported three high findings, including this advisory. The other findings were outside this review.

The reviewed GitHub advisory covers versions through 4.2.0 and lists no patched version. It describes an attacker-controlled Cache-Control: max-stale request causing a shared cache to reuse a security-restricted response through satisfiesWithoutRevalidation(), potentially exposing another user's cached response or cookie. npm view http-cache-semantics version returned 4.2.0 on the review date. Upstream fix PR #58 was open. npm audit suggested Astro 2.10.9 as a semver-major change; it is not a compatible fix for the Astro 7 example or integration.

Inspection of the installed Astro 7.3.5 distribution found one import of this library, in dist/assets/build/remote.js. That code calls storable() and timeToLive() to calculate remote-image expiry; it does not call satisfiesWithoutRevalidation(). A search of Astro's installed dist found no call to the vulnerable method. E02's checked-in source uses no Astro remote-image API. These observations do not prove that other applications, caches, or future Astro versions cannot reach the vulnerable behavior.

Release decision and recheck

This advisory is recorded as an Astro development/example dependency warning. On the inspected source path it is not a demonstrated core package exploit and does not by itself block a core npm release candidate. Do not override the dependency with an unreleased PR or downgrade the example to Astro 2. Recheck the upstream advisory and installed Astro call sites before publishing the example as a production deployment guide, and update the lockfiles when a supported patched release exists. Applications using their own shared cache must assess that cache separately.

Evidence commands: npm explain http-cache-semantics, npm audit --omit=dev --json, npm audit --json in the root and E02 baseline, npm view http-cache-semantics version, and a source search for http-cache-semantics and satisfiesWithoutRevalidation under installed node_modules/astro/dist.