Cyber Resilience

CVE-2026-41322

Published
24 April 2026
Modified
27 April 2026
CVSS Score v3.1 5.3
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
EPSS Score 0.0024 15th percentile
Risk Priority 43 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2026-41322 is a medium-severity Use of Web Browser Cache Containing Sensitive Information (CWE-525) vulnerability. Its CVSS base score is 5.3 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Data from Local System (T1005); ranked at the 15th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

OWASP Top 10 for Web (2025)

A06:2025 Insecure Design

EU & UK References

Vulnerability Data

@astrojs/node allows Astro to deploy your SSR site to Node targets. Prior to 10.0.5, requesting a static js/css resources from _astro path with an incorrect/malformed if-match header returns a 500 error with a one year cache lifetime instead of 412…

more

in some cases. This has the effect that all subsequent requests to that file, regardless of if-match header will be served a 5xx error instead of the file until the cache expires. This vulnerability is fixed in 10.0.5.

CWE(s)
CWE-525

Related Threats

MITRE ATT&CK Enterprise Techniques

T1005 Data from Local System Collection
Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.
attack.mitre.org →
T1552 Unsecured Credentials Credential Access
Adversaries may search compromised systems to find and obtain insecurely stored credentials.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2025-1348Shared CWE-525
CVE-2024-25142Shared CWE-525
CVE-2025-48947Shared CWE-525
CVE-2024-22349Shared CWE-525
CVE-2025-1334Shared CWE-525
CVE-2023-23469Shared CWE-525
CVE-2023-43035Shared CWE-525
CVE-2024-30130Shared CWE-525
CVE-2024-23571Shared CWE-525
CVE-2025-52625Shared CWE-525

Affected Assets

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

—

Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)
  • V14.2.5
  • V14.3.2

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-01 mostly match
prevents

Configuration baselines and enforcement directly require proper Cache-Control and related headers.

PR.PS-06 mostly match
prevents

Secure SDLC practices include defining and verifying appropriate web caching policies for sensitive content.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.1 User end point devices partial match
degrades

Endpoint device configuration can enforce cache-clearing or no-cache policies for sensitive web content.

A.8.26 Application security requirements partial match
prevents

Application security requirements can explicitly require no-cache headers or cache-control directives for sensitive pages.

A.8.28 Secure coding partial match
prevents

Secure coding standards can mandate proper cache-control headers and form-field handling to prevent sensitive data retention.

A.8.9 Configuration management partial match
prevents

Configuration management can mandate secure browser cache settings across the estate.

References