Build and Deploy Universal JavaScript Servers
91%
Total Score
healthy
Healthy release, supported by active maintenance and strong project transparency.
This is a prerelease beta and 55% of recent releases are prereleases, so consumers should expect some instability despite the stable major line.
All four workflows were analyzed, use read-only permissions, and pin all 23 action references. High-confidence adhoc package installations and trusted-publishing audit findings create modest hygiene and publishing-process concerns; the high-severity cache finding has low confidence and is therefore limited to hygiene impact.
| Title | Versions | Severity |
|---|---|---|
CVE-2026-44372 nitro is vulnerable to URL Redirection to Untrusted Site ('Open Redirect') in versions 0.0.0 - 3.0.260429-beta. | 0.0.0 - 3.0.260429-beta | Medium |
CVE-2026-44373 nitro is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in versions 0.0.0 - 3.0.260429-beta. | 0.0.0 - 3.0.260429-beta | Medium |
| Dependency | Last Release | Score |
|---|---|---|
h3 Version ^2.0.1-rc.31 | — | — |
db0 Version ^0.4.1 | — | — |
nf3 Version ^0.3.24 | — | — |
rou3 Version ^0.9.2 | — | — |
srvx Version ^1.0.3 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.