https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 21:32:14 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-318487 EUVD-2026-318487 https://cve.radiocsirt.org/vuln/euvd-2026-318487 https://cve.radiocsirt.org/vuln/fkie_cve-2026-44373 <p>Nitro is a next generation server toolkit. Prior to 3.0.260429-beta, an attacker could bypass a proxy route rule by sending percent-encoded path traversal (..%2f) in the URL, causing Nitro to forward a request that the upstream resolved outside the configured scope. This vulnerability is fixed in 3.0.260429-beta.</p> <p>Nitro is a next generation server toolkit. Prior to 3.0.260429-beta, an attacker could bypass a proxy route rule by sending percent-encoded path traversal (..%2f) in the URL, causing Nitro to forward a request that the upstream resolved outside the configured scope. This vulnerability is fixed in 3.0.260429-beta.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-44373 https://cve.radiocsirt.org/vuln/ghsa-5w89-w975-hf9q <p><strong>Affected:</strong> npm: nitro, npm: nitropack</p> <p>A proxy route rule like:</p> <p>```ts routeRules: { &#34;/api/orders/**&#34;: { proxy: { to: &#34;http://upstream/orders/**&#34; } } } ```</p> <p>is intended to limit the proxy to URLs under `/api/orders/`. Before the patch, an attacker could bypass that scope by sending percent-encoded path traversal (`..%2f`) in the URL, causing Nitro to forward a request that the upstream resolved outside the configured scope. Example exploit:</p> <p>``` GET /api/orders/..%2fadmin%2fconfig.json ```</p> <p>Nitro sees `..%2f` as opaque characters at match time, the `/api/orders/**` rule matched, and the raw path was forwarded to the upstream as `/orders/..%2fadmin/config.json`. An upstream that decodes `%2F` to `/` then resolved `..` and can serve `/admin/config.json` outside the intended scope.</p> <p>### Are you affected?</p> <p>Users may be affected if **ALL** of the following are true:</p> <p>1. Their project uses Nitro&#39;s `routeRules` with a `proxy` entry (`{ proxy: { to: &#34;...&#34; } }`). 2. The proxy `to` value uses a `/**` wildcard suffix to forward sub-paths. 3. The **upstream** behind the proxy decodes `%2F` as `/` before routing or filesystem lookup. 4. Proxy route rules are _not_ handled natively at CDN (nitro v3 and vercel)</p> <p>Whether the bypass actually leaks data depends on the upstream. Modern JS frameworks keep `%2F` opaque per RFC 3986 and are safe by construction.</p> <p>- **Safe examples:** H3 v2, Express v5, Hono v4 — modern JS frameworks keep `%2F` opaque per RFC 3986. - **Vulnerable examples:** naive imlementations that decodes the UR…</p> <p><strong>Affected:</strong> npm: nitro, npm: nitropack</p> <p>A proxy route rule like:</p> <p>```ts routeRules: { &#34;/api/orders/**&#34;: { proxy: { to: &#34;http://upstream/orders/**&#34; } } } ```</p> <p>is intended to limit the proxy to URLs under `/api/orders/`. Before the patch, an attacker could bypass that scope by sending percent-encoded path traversal (`..%2f`) in the URL, causing Nitro to forward a request that the upstream resolved outside the configured scope. Example exploit:</p> <p>``` GET /api/orders/..%2fadmin%2fconfig.json ```</p> <p>Nitro sees `..%2f` as opaque characters at match time, the `/api/orders/**` rule matched, and the raw path was forwarded to the upstream as `/orders/..%2fadmin/config.json`. An upstream that decodes `%2F` to `/` then resolved `..` and can serve `/admin/config.json` outside the intended scope.</p> <p>### Are you affected?</p> <p>Users may be affected if **ALL** of the following are true:</p> <p>1. Their project uses Nitro&#39;s `routeRules` with a `proxy` entry (`{ proxy: { to: &#34;...&#34; } }`). 2. The proxy `to` value uses a `/**` wildcard suffix to forward sub-paths. 3. The **upstream** behind the proxy decodes `%2F` as `/` before routing or filesystem lookup. 4. Proxy route rules are _not_ handled natively at CDN (nitro v3 and vercel)</p> <p>Whether the bypass actually leaks data depends on the upstream. Modern JS frameworks keep `%2F` opaque per RFC 3986 and are safe by construction.</p> <p>- **Safe examples:** H3 v2, Express v5, Hono v4 — modern JS frameworks keep `%2F` opaque per RFC 3986. - **Vulnerable examples:** naive imlementations that decodes the UR…</p> https://cve.radiocsirt.org/vuln/ghsa-5w89-w975-hf9q