Repository navigation
Regression - Sec-fetch-dest: image header causes 404 on API-served images (regression in 3.0.260429-beta) #4241
Description
Environment
Runtime
- node 24.7.0
- npm 11.5.1
- bun 1.3.3
Nitro
- nitro 3.0.260429-beta
Reproduction
Reproduction example repository
https://github.com/TheUniqueMathemagician/nitro-issue
To reproduce
Make a request to a TanStack Start API endpoint (e.g. /api/images/$id/file) that serves images dynamically, and include the sec-fetch-dest: image header, or simply use an <img> tag pointing to that endpoint, as browsers (e.g. Brave, Chrome, Edge, ...) add this header automatically for image requests.
Describe the bug
After upgrading from 3.0.260415-beta to 3.0.260429-beta, dynamically served images return 404 Not Found when the request includes the Sec-Fetch-Dest: image header.
This header is automatically added by browsers whenever an <img> tag loads a resource. The images are not static files in a /public folder, they are served through TanStack Router's API route at /api/images/$id/file (in my case).
The regression appears to be introduced by PR #4238, which added sec-fetch-dest-aware logic that seems to intercept requests with sec-fetch-dest: image before they reach the API handler, returning a 404 instead.
All other request methods (direct browser URL, cURL, Postman) work correctly when the Sec-Fetch-Dest header is absent.
Additional context
The following Nitro config options were attempted to disable static asset serving, but none had any effect on the issue — the interception appears to happen upstream of the asset configuration:
nitro({
apiBaseURL: "/api",
noPublicDir: true,
serveStatic: false,
// publicAssets: [],
publicAssets: [{
baseURL: "/",
dir: resolve(import.meta.dirname, "publics"),
fallthrough: true,
ignore: ["**/*"],
maxAge: 60 * 60 * 24 * 7,
}],
})Logs
(no additional logs — the only observable symptom is a 404 response on the image endpoint when Sec-Fetch-Dest: image is present)
Activity
pi0 commentedon Apr 30, 2026
Can you please make a minimal (nitro only) reproduction?
TheUniqueMathemagician commentedon May 1, 2026
I created two additional branches on https://github.com/TheUniqueMathemagician/nitro-issue to help you narrow down the issue:
refactor/nitro-only— Nitro standalone, no other dependencies. The issue does not reproduce here; the dynamic image route works correctly.refactor/nitro-vite— Nitro used as a Vite plugin. The issue does reproduce here.The
mainbranch reflects my actual use case (TanStack Start + Vite), but based on the above, TanStack Start is not the culprit. The regression appears to be specific to the Nitro Vite plugin.I tried to get the minimal reproduction down to Nitro only, but since the bug doesn't show there, the
refactor/nitro-vitebranch is the smallest reproduction I could get.pi0 commentedon May 1, 2026
Thanks for confirming. Fix should be available in nightly
fix(vite): route extensionless URLs matching a nitro route to nitro u…
TheUniqueMathemagician commentedon May 1, 2026
It works on the Nightly version 🤞 Good job and thank you a lot for you reactivity !
zenios commentedon May 2, 2026
In my project i still have a regression. It differs a bit from these exact description but its almost the same issue.
What i am doing is proxying all /assets to an external server. meaning if i have an
it will be handled by my proxy route.
The problem is that now any assets request goes directly to vite bypassing my handler
pi0 commentedon May 3, 2026
@zenios can you please open a new issue with reproduction so we can track?
fix(vite): route extensionless URLs matching a nitro route to nitro u…
fix(web): load API-served media in development