p PatchFirst

PatchFirst · Latest vulnerabilities

nitro vulnerabilities

Vulnerabilities published for nitro in the last 30 days: 0. Listed in the KEV catalogue: 0.

RSS ↗ JSON ↗
Filter vulnerabilities
Clear filters

Vulnerabilities: 2

  1. CVE-2026-44372

    Medium · CVSS 5.3EPSS 0.28%Fix available

    Nitro: Open Redirect via Protocol-Relative URL Bypass in Wildcard Route Rules

    Nitro is a next generation server toolkit. Prior to 3.0.260429-beta, an attacker could turn a redirect route rule using wildcards rewrite into a cross-host redirect by sliding an extra slash in after the rule prefix. This vulnerability is fixed in 3.0.260429-beta.

    nitroNode.js
    • Update to 3.0.260429-beta
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  2. CVE-2026-44373

    Medium · CVSS 5.3EPSS 0.45%Fix available

    Nitro: Proxy scope bypass via percent-encoded path traversal in `routeRules`

    Nitro is a next generation server toolkit. Prior to 3.0.260429-beta, an attacker could bypass a proxy route rule by sending percent-encoded path traversal (..%2f) in the URL, causing Nitro to forward a request that the upstream resolved outside the configured scope. This vulnerability is fixed in 3.0.260429-beta.

    nitroNode.js
    • Update to 3.0.260429-beta
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →