nitro

3.0.260903-beta · 3 Sept 2026MIT7.5M / weekRepository Homepage npm Atom feed

Security advisories

From OSV. Open ones first, then the most severe. "Fixed in" is read against the latest release, 3.0.260903-beta.

Severity	Advisory	Affected	Fixed in
Moderate	Nitro has an Open Redirect via Protocol-Relative URL Bypass in Wildcard Route RulesGHSA-9phm-9p8f-hw5m · 6 May 2026	< 3.0.260429-beta	3.0.260429-beta
Moderate	Nitro has a proxy scope bypass via percent-encoded path traversal in `routeRules`GHSA-5w89-w975-hf9q · 6 May 2026	< 3.0.260429-beta	3.0.260429-beta

What npm and deps.dev say about the latest release. Signals, not a verdict.

Reading npm and deps.dev…

Registry facts last checked 20 October 2026. Releases and advisories last read 20 October 2026.