CVE-2026-44372

Nitro is a next generation server toolkit. Prior to 3.0.260429-beta, an attacker could turn a redirect route rule using wildcards rewrite into a cross-host redirect by sliding an extra slash in after the rule prefix. This vulnerability is fixed in 3.0.260429-beta.

CVSS v3 6.1 MEDIUM

6.1^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/nitrojs/nitro/pull/4236	Issue Tracking Patch
https://github.com/nitrojs/nitro/releases/tag/v2.13.4	Release Notes
https://github.com/nitrojs/nitro/releases/tag/v3.0.260429-beta	Release Notes
https://github.com/nitrojs/nitro/security/advisories/GHSA-9phm-9p8f-hw5m	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:nitro:nitro::::::::
	cpe:2.3:a:nitro:nitro::::::::

History

26 Oct 2026, 14:10

Type	Values Removed	Values Added
Summary		(es) Nitro es un kit de herramientas de servidor de próxima generación. Antes de 3.0.260429-beta, un atacante podría convertir una regla de ruta de redirección que utiliza la reescritura de comodines en una redirección entre hosts deslizando una barra adicional después del prefijo de la regla. Esta vulnerabilidad está corregida en 3.0.260429-beta.

Information

Published : 2026-05-13 21:16

Updated : 2026-10-26 14:10

NVD link : CVE-2026-44372

Mitre link : CVE-2026-44372

CVE.ORG link : CVE-2026-44372

JSON object : View

Products Affected

nitro

nitro

CWE

CWE-601

URL Redirection to Untrusted Site ('Open Redirect')

{"id": "CVE-2026-44372", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44372", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-05-14T15:46:57.649072Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "nitrojs", "product": "nitro", "versions": [{"status": "affected", "version": "< 3.0.260429-beta"}]}, {"vendor": "nitrojs", "product": "nitropack", "versions": [{"status": "affected", "version": "< 2.13.4"}]}]}], "published": "2026-05-13T21:16:47.890", "references": [{"url": "https://github.com/nitrojs/nitro/pull/4236", "tags": ["Issue Tracking", "Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/nitrojs/nitro/releases/tag/v2.13.4", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/nitrojs/nitro/releases/tag/v3.0.260429-beta", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/nitrojs/nitro/security/advisories/GHSA-9phm-9p8f-hw5m", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-601"}]}], "descriptions": [{"lang": "en", "value": "Nitro is a next generation server toolkit. Prior to 3.0.260429-beta, an attacker could turn a redirect route rule using wildcards rewrite into a cross-host redirect by sliding an extra slash in after the rule prefix. This vulnerability is fixed in 3.0.260429-beta."}, {"lang": "es", "value": "Nitro es un kit de herramientas de servidor de pr\u00f3xima generaci\u00f3n. Antes de 3.0.260429-beta, un atacante podr\u00eda convertir una regla de ruta de redirecci\u00f3n que utiliza la reescritura de comodines en una redirecci\u00f3n entre hosts deslizando una barra adicional despu\u00e9s del prefijo de la regla. Esta vulnerabilidad est\u00e1 corregida en 3.0.260429-beta."}], "lastModified": "2026-10-26T14:10:00.130", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:nitro:nitro:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4184D77E-DD83-4720-ADE4-08D6DE54CFC2", "versionEndExcluding": "2.13.4"}, {"criteria": "cpe:2.3:a:nitro:nitro:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B7044A13-4A34-453D-AEDD-537368D23865", "versionEndExcluding": "3.0.260429", "versionStartExcluding": "2.13.4"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}