502 Unsafe upstream redirect when Meta Pixel's /tr endpoint returns 302

[i-kyvatskyi]

🐛 The bug

Env
@nuxt/scripts@1.3.5
nuxt@4.4.8

Config:

scripts: {
    registry: {
      googleTagManager: {
        id: GTM_ID,
        trigger: 'onNuxtReady',
        bundle: false,
      },
      metaPixel: {
        id: META_PIXEL_KEY,
        trigger: 'onNuxtReady',
      },
      googleAnalytics: {
        id: GOOGLE_ANALYTICS_KEY,
        trigger: 'onNuxtReady',
      },
    },
  },

Intermittently, POST /_scripts/p/www.facebook.com/tr/ fails with a 502 Unsafe upstream redirect because Facebook responds with a 302 for this particular request, and the first-party proxy handler refuses to follow it.

In proxy-handler.ts, the fetch to the upstream is always made with redirect: manual, and any 3xx response other than 304 throws a 502:

const requestInit: RequestInit = {
  ...
  redirect: 'manual',
}
...
if (response.status >= 300 && response.status < 400 && response.status !== 304) {
  throw createError({
    statusCode: 502,
    statusMessage: 'Unsafe upstream redirect',
    message: 'Proxy upstream returned a redirect that was not followed',
  })
}

I understand this is intentional — following the Location header would mean sending a request to a host that was never validated against the domain allowlist (SSRF risk), so blindly following it isn't safe. I noticed image-proxy.ts already has a followRedirects option that re-validates each hop against the same allowlist before following it — is something similar planned/possible for the event-collection proxy handler used by registry scripts like Meta Pixel?

🛠️ To reproduce

🌈 Expected behavior

ℹ️ Additional context

No response

[harlan-zw]

🤖 ISSUE TRIAGE

Harlan Agent Kit posted this automated triage. It is not Harlan's personal assessment or commitment. AI open source policy.

• Route: Ready to implement
• Difficulty: 3/5
• Impact: 3/5
• Reproduction: Yes
• Codebase review: Not needed
• Summary: Meta Pixel's /tr endpoint intermittently returns 302 and the first-party event proxy (proxy-handler.ts:564) converts every non-304 3xx into a 502 'Unsafe upstream redirect', silently dropping analytics events. The hard block is intentional
• Next action: Implement a validated manual redirect loop in packages/script/src/runtime/server/proxy-handler.ts modeled on resolveRedirect in cached-upstream.ts: on 3xx (non-304) resolve Location against the current URL, reject any hop failing isPublicNe