Skip to content
CVE PROGRAM SOURCE RECORD5.3 Medium

CVE-2026-44372

Nitro: Open Redirect via Protocol-Relative URL Bypass in Wildcard Route Rules

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
GitHub_M

Description

Nitro is a next generation server toolkit. Prior to 3.0.260429-beta, an attacker could turn a redirect route rule using wildcards rewrite into a cross-host redirect by sliding an extra slash in after the rule prefix. This vulnerability is fixed in 3.0.260429-beta.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

nitrojs nitro

  • < 3.0.260429-betaaffected

nitrojs nitropack

  • < 2.13.4affected

References