Repository navigation
Conversation
logaretm
added this pull request to stack #25201
October 15, 2026 15:51
![semgrep-code-getsentry[bot]](https://avatars.githubusercontent.com/in/1153895?s=60&v=4){kind=small}
| return; | ||
| } | ||
|
|
||
| const tunnelResponse = handleTunnelRequestIfMatched(toWebRequest(event)); |
There was a problem hiding this comment.
🟠 High severity issue identified in your code:
Risk: Affected versions of h3 are vulnerable to Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling'). The readRawBody function in h3 performs a strict, case-sensitive check for "chunked" in the Transfer-Encoding header. If an attacker sends a mixed-case value (e.g. "Transfer-Encoding: ChuNked") and no Content-Length, h3 will assume an empty body, immediately process the request, and leave the real payload data on the socket. When h3 is deployed behind a Layer 4 proxy (such as AWS NLB or raw TCP proxies that don't normalize headers), this enables a classic TE.TE HTTP request smuggling attack—allowing an attacker to bypass WAFs or desynchronize and poison other users' connections.
Fix: Upgrade this library to at least version 1.15.5 at sentry-javascript/yarn.lock:16852.
Reference(s): https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-2737, GHSA-mp2g-9vg9-f4cg, CVE-2026-23527
🥳 Fixed in commit 7f609cc 🥳
Member
Author
There was a problem hiding this comment.
Something to do in an external PR.
logaretm
force-pushed
the
awad/tunnel-nitro
branch
from
October 15, 2026 15:59
7fe783d to
f1e1f59
Compare
Contributor
size-limit report 📦
|
logaretm
force-pushed
the
awad/tunnel-nitro
branch
from
October 15, 2026 16:20
f1e1f59 to
ab2c887
Compare
logaretm
force-pushed
the
awad/tunnel-nitro
branch
2 times, most recently
from
October 15, 2026 17:15
9765090 to
9bad613
Compare
logaretm
force-pushed
the
awad/tunnel-nitro
branch
2 times, most recently
from
October 15, 2026 17:44
c1733f2 to
fdca10d
Compare
logaretm
force-pushed
the
awad/tunnel-nitro
branch
from
October 15, 2026 18:16
fdca10d to
f17f89e
Compare
logaretm
force-pushed
the
awad/tunnel-nitro
branch
from
October 15, 2026 18:26
f17f89e to
fadf52a
Compare
logaretm
force-pushed
the
awad/tunnel-nitro
branch
from
October 15, 2026 18:28
fadf52a to
e1a3c68
Compare
Member
Author
|
bugbot run |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
✅ Bugbot reviewed your changes and found no new issues!
Comment @cursor review or bugbot run to trigger another review on this PR
Reviewed by Cursor Bugbot for commit e1a3c68. Configure here.
logaretm
force-pushed
the
awad/tunnel-nitro
branch
from
October 16, 2026 01:51
e1a3c68 to
305aa01
Compare
logaretm
force-pushed
the
awad/tunnel-nitro
branch
2 times, most recently
from
October 16, 2026 04:23
3596b0a to
ec58ad6
Compare
logaretm
force-pushed
the
awad/tunnel-nitro
branch
from
October 16, 2026 14:00
ec58ad6 to
42c2c08
Compare
logaretm
force-pushed
the
awad/tunnel-nitro
branch
from
October 18, 2026 01:08
894eb61 to
d3a7266
Compare
logaretm
force-pushed
the
awad/tunnel-nitro
branch
from
October 19, 2026 02:38
65817f4 to
f363e89
Compare
logaretm
force-pushed
the
awad/tunnel-nitro
branch
from
October 19, 2026 03:07
f363e89 to
cfb9625
Compare
logaretm
force-pushed
the
awad/tunnel-nitro
branch
from
October 19, 2026 04:58
cfb9625 to
fb58f66
Compare
logaretm
force-pushed
the
awad/tunnel-nitro
branch
from
October 19, 2026 15:32
fb58f66 to
7f609cc
Compare
logaretm
force-pushed
the
awad/tunnel-nitro
branch
from
October 19, 2026 17:08
7f609cc to
a09825b
Compare
logaretm
force-pushed
the
awad/tunnel-nitro
branch
from
October 19, 2026 17:34
a09825b to
5380b46
Compare
logaretm
force-pushed
the
awad/tunnel-nitro
branch
from
October 19, 2026 18:15
5380b46 to
c754c41
Compare
logaretm
force-pushed
the
awad/tunnel-nitro
branch
from
October 19, 2026 18:22
c754c41 to
b0192c1
Compare
…iddleware On Nitro v3, Nuxt and `@sentry/nitro` put the tunnel check first in h3's middleware list, since Nitro runs the app's `server/middleware` before anything a module registers and has no public way to go first. On Nitro v2, Nuxt answers from the `request` hook.
…oute rules can't skip it
… rules don't run after it
…yCloudflareNitroPlugin
…lts so Cloudflare clients start with it
`nuxt dev` opens the port before it can serve and answers 503 until then, while Playwright only waits for the port.
logaretm
force-pushed
the
awad/tunnel-nitro
branch
from
October 19, 2026 18:36
b0192c1 to
27d096c
Compare
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A Nitro app's own
server/middleware, like an auth check, ran before anything Sentry registered and would block tunnel requests, fixed by putting the tunnel check first in h3's middleware on Nitro v3 and answering from therequesthook on Nitro v2.The e2e tunnel variants for Nuxt 4, Nuxt 5 and Nitro 3 check that the tunnel answers while an auth middleware rejects every other POST.
closes #20254