Threats affecting pkg:github/nitrojs/nitro

Nitro is a next generation server toolkit. Prior to 3.0.260429-beta, an attacker could turn a redirect route rule using wildcards rewrite into a cross-host redirect by sliding an extra slash in after the rule prefix. This vulnerability is fixed in 3.0.260429-beta.

CVE-2026-44373 is a medium severity path traversal vulnerability in the Nitro server toolkit prior to version 3.0.260429-beta. An attacker could bypass proxy route rules by sending percent-encoded path traversal sequences in the URL, causing Nitro to forward requests outside the intended scope. This could lead to unauthorized access to resources outside the configured directory. The vulnerability is fixed starting with version 3.0.260429-beta. No known exploits are reported in the wild at this time.