GHSA-pqxc-r4h5-jc95: 
JavaScript vulnerability analysis and mitigation

Summary

A wildcard redirect route rule whose target is /** copies the rest of the request path into the Location header. The 2.13.4 fix for GHSA-9phm-9p8f-hw5m collapses only a leading //, and only when the rule has no strip base. A remainder that starts with a backslash (raw or %5C) or with a tab followed by a slash (%09/) is emitted unchanged. Browsers treat \ as / in special-scheme URLs and strip tab, LF and CR, so /\evil.example and /<TAB>/evil.example resolve to //evil.example, a cross-origin redirect.

Details

Affected code (nitropack v2):

• src/runtime/internal/route-rules.ts, redirect branch:
  • With a strip base ('/old/**'): isPathInScope() passes, because WHATWG URL canonicalizes \ to / and the path stays under /old. Then withoutBase(event.path, base) returns /\evil.example unchanged, and joinURL("/", ...) keeps it.
  • Without a strip base ('/**'): only ^//+ is collapsed. /\, /%5C and /<TAB>/ pass through.
• h3 v1 has already decoded %5C and %09 in event.path, so the Location contains the literal characters.

Proof of concept

export default defineNitroConfig({
  routeRules: { "/old/**": { redirect: "/**" } },
});

Impact

An attacker sends a victim a link on the trusted site, such as https://victim.example/old/%5Cevil.example. The site redirects the victim's browser to an attacker-controlled origin. You are affected if all of these are true:

• you use nitropack v2 (including Nuxt 3 and 4 on nitropack 2);
• you have a redirect route rule whose target is exactly /**, with nothing before it;
• the Nitro runtime handles the redirect, not a platform's generated config.

Patches

Fixed in nitropack 2.13.6. Any leading run of slashes, backslashes, control characters and their percent-encoded forms in the redirect remainder is collapsed to a single /, so the Location header is always a same-origin path.

Workarounds

If you cannot upgrade:

• use a redirect target with a non-empty prefix (for example /new/** instead of /**);
• or define the redirect in your platform's or reverse proxy's configuration instead of a Nitro route rule.