Nitro has a proxy scope bypass via percent-encoded path traversal in `routeRules`

Description

A proxy route rule like:

is intended to limit the proxy to URLs under /api/orders/. Before the patch, an attacker could bypass that scope by sending percent-encoded path traversal (..%2f) in the URL, causing Nitro to forward a request that the upstream resolved outside the configured scope. Example exploit:

Nitro sees ..%2f as opaque characters at match time, the /api/orders/** rule matched, and the raw path was forwarded to the upstream as /orders/..%2fadmin/config.json.

Recommendation

Update the nitropack package to the latest compatible version. Followings are version details:

• Affected version(s): < 2.13.4
• Patched version(s): 2.13.4

References

• GHSA-5w89-w975-hf9q
• CVE-2026-44373
• CWE-22
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• Nitro has a proxy scope bypass via percent-encoded path traversal in `routeRules` - nitro - CVE-2026-44373
• fast-uri vulnerable to path traversal via percent-encoded dot segments - CVE-2026-6321
• Nitro has an Open Redirect via Protocol-Relative URL Bypass in Wildcard Route Rules - CVE-2026-44372
• Nitro has an Open Redirect via Protocol-Relative URL Bypass in Wildcard Route Rules - nitro - CVE-2026-44372

You might also like:

Apache and Express Path Traversal plus Nginx Restriction Bypass Tests with SmartScanner

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

nitropack