# Astro cache advisory review (2026-10-03)

Source snapshot: public `main` at `79f7e4ea8324ed616d83c04715a1eaf4dd175144`. Review ran in an isolated macOS clone with Node.js 25.9.0 and npm; this is a dependency/source review, not a deployed attack test. No release dependency was changed.

## Dependency and affected surface

`npm explain http-cache-semantics` resolves `astro@7.3.5 -> http-cache-semantics@4.2.0`. The root lockfile marks this path `dev: true`; the package declares Astro as an optional peer, not a hard runtime dependency. E02's `site-before` lockfile and generated project's package template explicitly use Astro 7.3.5. In the isolated clone, `npm audit --omit=dev --json` found zero root production vulnerabilities, while the full root audit reported two high findings and the E02 baseline audit reported three high findings, including this advisory. The other findings were outside this review.

The [reviewed GitHub advisory](https://github.com/advisories/GHSA-ch52-4w7c-c8xp) covers versions through 4.2.0 and lists no patched version. It describes an attacker-controlled `Cache-Control: max-stale` request causing a shared cache to reuse a security-restricted response through `satisfiesWithoutRevalidation()`, potentially exposing another user's cached response or cookie. `npm view http-cache-semantics version` returned 4.2.0 on the review date. [Upstream fix PR #58](https://github.com/kornelski/http-cache-semantics/pull/58) was open. npm audit suggested Astro 2.10.9 as a semver-major change; it is not a compatible fix for the Astro 7 example or integration.

Inspection of the installed Astro 7.3.5 distribution found one import of this library, in `dist/assets/build/remote.js`. That code calls `storable()` and `timeToLive()` to calculate remote-image expiry; it does not call `satisfiesWithoutRevalidation()`. A search of Astro's installed `dist` found no call to the vulnerable method. E02's checked-in source uses no Astro remote-image API. These observations do not prove that other applications, caches, or future Astro versions cannot reach the vulnerable behavior.

## Release decision and recheck

This advisory is recorded as an Astro development/example dependency warning. On the inspected source path it is not a demonstrated core package exploit and does not by itself block a core npm release candidate. Do not override the dependency with an unreleased PR or downgrade the example to Astro 2. Recheck the upstream advisory and installed Astro call sites before publishing the example as a production deployment guide, and update the lockfiles when a supported patched release exists. Applications using their own shared cache must assess that cache separately.

Evidence commands: `npm explain http-cache-semantics`, `npm audit --omit=dev --json`, `npm audit --json` in the root and E02 baseline, `npm view http-cache-semantics version`, and a source search for `http-cache-semantics` and `satisfiesWithoutRevalidation` under installed `node_modules/astro/dist`.