Executive brief
Nitro is a server toolkit used to build and deploy web applications. A flaw in its proxy routing rules allows attackers to bypass intended access scopes by using percent-encoded path traversal sequences in URLs. An attacker could potentially access restricted internal endpoints, admin panels, or other services that should be protected by the scope rules, depending on how the upstream server decodes URLs.
Technical details
The vulnerability is a path traversal flaw in Nitro's routeRules handling when proxy directives with wildcard suffixes (/**) are configured. When matching incoming URLs, Nitro does not canonicalize percent-encoded sequences before evaluating the route scope. An attacker can send a request like GET /api/orders/..%2fadmin%2fconfig.json; Nitro sees %2f as opaque and matches it against the /api/orders/** rule, then forwards the raw path to the upstream service. If the upstream decodes %2F to / before routing or filesystem access, path traversal occurs and the attacker reaches /admin/config.json outside the intended scope. The attack requires: (1) Nitro configured with proxy rules using /** wildcards, (2) an upstream that decodes percent-encoded forward slashes, and (3) network access to the Nitro server. The fix, released in Nitro v2.13.4 and v3.0.260429-beta or later, canonicalizes paths before URL construction and rejects requests with a 400 Bad Request if the resolved path escapes the rule's base.
Affected products
- Nitro nitro < 3.0.260429-beta
- Nitro nitropack < 2.13.4
Timeline
- 2026-05-06: disclosed: GHSA-5w89-w975-hf9q published
- 2026-04-29: patched: v2.13.4 and v3.0.260429-beta released with fix
References
- https://github.com/nitrojs/nitro/security/advisories/GHSA-5w89-w975-hf9q
- https://github.com/nitrojs/nitro/pull/4222
- https://github.com/nitrojs/nitro/pull/4223
- https://github.com/nitrojs/nitro
- https://github.com/nitrojs/nitro/releases/tag/v2.13.4
- https://github.com/nitrojs/nitro/releases/tag/v3.0.260429-beta