Repository navigation
Conversation
logaretm
added this pull request to stack #25201
October 15, 2026 15:51
![semgrep-code-getsentry[bot]](https://avatars.githubusercontent.com/in/1153895?s=60&v=4){kind=small}
| return; | ||
| } | ||
|
|
||
| const tunnelResponse = handleTunnelRequestIfMatched(toWebRequest(event)); |
There was a problem hiding this comment.
🟠 High severity and reachable issue identified in your code:
Line 16 has a potentially vulnerable usage of h3, possibly introducing a high severity vulnerability.
ℹ️ Why this is reachable
A reachable issue is a possible security risk because your project actually executes the vulnerable code. This issue is reachable because your code calls vulnerable code in this version of h3.
Affected versions of h3 are vulnerable to Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling'). The readRawBody function in h3 performs a strict, case-sensitive check for "chunked" in the Transfer-Encoding header. If an attacker sends a mixed-case value (e.g. "Transfer-Encoding: ChuNked") and no Content-Length, h3 will assume an empty body, immediately process the request, and leave the real payload data on the socket. When h3 is deployed behind a Layer 4 proxy (such as AWS NLB or raw TCP proxies that don't normalize headers), this enables a classic TE.TE HTTP request smuggling attack—allowing an attacker to bypass WAFs or desynchronize and poison other users' connections.
References: https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-2737, GHSA, CVE
To resolve this comment:
Upgrade this dependency to at least version 1.15.5 at yarn.lock.
💬 Ignore this finding
To ignore this, reply with:
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
You can view more details on this finding in the Semgrep AppSec Platform here.
Member
Author
There was a problem hiding this comment.
Something to do in an external PR.
logaretm
force-pushed
the
awad/tunnel-nitro
branch
from
October 15, 2026 15:59
7fe783d to
f1e1f59
Compare
Contributor
size-limit report 📦
|
logaretm
force-pushed
the
awad/tunnel-nitro
branch
from
October 15, 2026 16:20
f1e1f59 to
ab2c887
Compare
logaretm
force-pushed
the
awad/tunnel-nitro
branch
2 times, most recently
from
October 15, 2026 17:15
9765090 to
9bad613
Compare
logaretm
force-pushed
the
awad/tunnel-nitro
branch
2 times, most recently
from
October 15, 2026 17:44
c1733f2 to
fdca10d
Compare
logaretm
force-pushed
the
awad/tunnel-nitro
branch
from
October 15, 2026 18:16
fdca10d to
f17f89e
Compare
logaretm
force-pushed
the
awad/tunnel-nitro
branch
from
October 15, 2026 18:26
f17f89e to
fadf52a
Compare
logaretm
force-pushed
the
awad/tunnel-nitro
branch
from
October 15, 2026 18:28
fadf52a to
e1a3c68
Compare
Member
Author
|
bugbot run |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
✅ Bugbot reviewed your changes and found no new issues!
Comment @cursor review or bugbot run to trigger another review on this PR
Reviewed by Cursor Bugbot for commit e1a3c68. Configure here.
logaretm
force-pushed
the
awad/tunnel-nitro
branch
from
October 16, 2026 01:51
e1a3c68 to
305aa01
Compare
logaretm
force-pushed
the
awad/tunnel-nitro
branch
2 times, most recently
from
October 16, 2026 04:23
3596b0a to
ec58ad6
Compare
logaretm
force-pushed
the
awad/tunnel-nitro
branch
from
October 16, 2026 14:00
ec58ad6 to
42c2c08
Compare
logaretm
force-pushed
the
awad/tunnel-nitro
branch
from
October 16, 2026 14:37
42c2c08 to
4e01dfe
Compare
logaretm
force-pushed
the
awad/tunnel-nitro
branch
from
October 16, 2026 16:15
4e01dfe to
00ae6ab
Compare
…iddleware On Nitro v3, Nuxt and `@sentry/nitro` put the tunnel check first in h3's middleware list, since Nitro runs the app's `server/middleware` before anything a module registers and has no public way to go first. On Nitro v2, Nuxt answers from the `request` hook.
logaretm
force-pushed
the
awad/tunnel-nitro
branch
from
October 16, 2026 17:56
00ae6ab to
530a56d
Compare
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A Nitro app's own
server/middleware, like an auth check, ran before anything Sentry registered and would block tunnel requests, fixed by putting the tunnel check first in h3's middleware on Nitro v3 and answering from therequesthook on Nitro v2.The e2e tunnel variants for Nuxt 4, Nuxt 5 and Nitro 3 check that the tunnel answers while an auth middleware rejects every other POST.
closes #20254