fix(deps): update dependency nitropack to v2.13.4 [security]#232
Open
renovate[bot] wants to merge 1 commit into
Open
fix(deps): update dependency nitropack to v2.13.4 [security]#232renovate[bot] wants to merge 1 commit into
renovate[bot] wants to merge 1 commit into
Conversation
renovate
Bot
force-pushed
the
renovate/npm-nitropack-vulnerability
branch
from
1e53c32 to
f3a26c0
Compare
Codecov Report✅ All modified and coverable lines are covered by tests. @@ Coverage Diff @@
## main #232 +/- ##
=======================================
Coverage 80.74% 80.74%
=======================================
Files 26 26
Lines 2462 2462
=======================================
Hits 1988 1988
Misses 474 474 🚀 New features to boost your workflow:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
2.13.1→2.13.4Nitro has a proxy scope bypass via percent-encoded path traversal in
routeRulesCVE-2026-44373 / GHSA-5w89-w975-hf9q
More information
Details
A proxy route rule like:
is intended to limit the proxy to URLs under
/api/orders/. Before the patch, an attacker could bypass that scope by sending percent-encoded path traversal (..%2f) in the URL, causing Nitro to forward a request that the upstream resolved outside the configured scope. Example exploit:Nitro sees
..%2fas opaque characters at match time, the/api/orders/**rule matched, and the raw path was forwarded to the upstream as/orders/..%2fadmin/config.json. An upstream that decodes%2Fto/then resolved..and can serve/admin/config.jsonoutside the intended scope.Are you affected?
Users may be affected if ALL of the following are true:
routeRuleswith aproxyentry ({ proxy: { to: "..." } }).tovalue uses a/**wildcard suffix to forward sub-paths.%2Fas/before routing or filesystem lookup.Whether the bypass actually leaks data depends on the upstream. Modern JS frameworks keep
%2Fopaque per RFC 3986 and are safe by construction.%2Fopaque per RFC 3986.os.path-based routing, anything sitting behind another layer that decodes%2F(common in microservice meshes).Impact
Any HTTP path reachable from the Nitro server to the upstream could be requested, regardless of the configured
/**scope. In typical deployments (API gateway, BFF, microservice proxy) this could expose internal admin endpoints, secrets endpoints, or other services the developer believed the scope rule fenced off.Patched versions
Upgrade to one of:
The fix canonicalizes the incoming pathname before building the upstream URL and rejects requests with
400 Bad Requestif the resolved path would escape the rule's base. The bytes forwarded upstream are unchanged when the request is allowed.Credits
Reported by @mHe4am (@he4am on HackerOne) via the Vercel Open Source program.
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Nitro has an Open Redirect via Protocol-Relative URL Bypass in Wildcard Route Rules
CVE-2026-44372 / GHSA-9phm-9p8f-hw5m
More information
Details
A redirect route rule like:
is intended to rewrite paths within the same host. Before the patch, an attacker could turn the rewrite into a cross-host redirect by sliding an extra slash in after the rule prefix. Example exploit:
Nitro stripped
/legacyfrom the matched pathname and joined the remainder against the rule's target. The remainder was//evil.com, which the join preserved verbatim, so Nitro responded withLocation: //evil.com. Browsers resolve//evil.comas a protocol-relative URL against the current scheme, sending the user tohttps://evil.com.Are you affected?
Users may be affected if all of the following are true:
routeRuleswith aredirectentry./**wildcard suffix to forward sub-paths (e.g.redirect: "/**",redirect: "/new/**",proxy: { to: "http://upstream/**" }).redirectrule is not handled natively at the CDN layer. Thevercel,netlify,cloudflare-pages, andedgeonepresets translaterouteRules.redirectinto platform config (vercel.json,_redirects, EdgeOne v3 config) and serve the redirect at the edge — those deployments bypass the Nitro runtime entirely and are not affected. Every other preset executes the redirect through the Nitro runtime and can be vulnerable.Impact
Open redirect from any host serving Nitro with a wildcard
redirectrule. The redirect target is fully attacker-controlled, the URL looks legitimate (it starts with the victim's domain), and the browser silently follows it.Patched versions
Upgrade to one of:
The fix has two parts:
ufois bumped to^1.6.4(unjs/ufo@5cd9e67), which collapses any run of leading slashes to a single/insidewithoutBase. This covers the typical"/scope/**"rule.//before joining when the rule path itself is/**(in rare case which casewithoutBaseis never called and the raw pathname flows straight intojoinURL("", …)).Severity
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
nitrojs/nitro (nitropack)
v2.13.4Compare Source
compare changes
🚀 Enhancements
🩹 Fixes
🏡 Chore
❤️ Contributors
v2.13.3Compare Source
compare changes
📦 Dependency Updates
httpxyh3esbuildrollup@vercel/nftc12cittydefuglobbylisthenunstoragecookie-esyouchv2.13.2Compare Source
compare changes
🩹 Fixes
..or outside of public dir (81f76800)📖 Documentation
Preset Changes
isr.exposeErrBody(f7753152)❤️ Contributors
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.