Nitro has a proxy scope bypass via percent-encoded path traversal in `routeRules` - nitro

Description

A proxy route rule like:

is intended to limit the proxy to URLs under /api/orders/. Before the patch, an attacker could bypass that scope by sending percent-encoded path traversal (..%2f) in the URL, causing Nitro to forward a request that the upstream resolved outside the configured scope. Example exploit:

Nitro sees ..%2f as opaque characters at match time, the /api/orders/** rule matched, and the raw path was forwarded to the upstream as /orders/..%2fadmin/config.json.

Recommendation

Update the nitro package to the latest compatible version. Followings are version details:

• Affected version(s): < 3.0.260429-beta
• Patched version(s): 3.0.260429-beta

References

• GHSA-5w89-w975-hf9q
• CVE-2026-44373
• CWE-22
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• Nitro has a proxy scope bypass via percent-encoded path traversal in `routeRules` - CVE-2026-44373
• fast-uri vulnerable to path traversal via percent-encoded dot segments - CVE-2026-6321
• Nitro has an Open Redirect via Protocol-Relative URL Bypass in Wildcard Route Rules - nitro - CVE-2026-44372
• i18next-http-backend has Path Traversal & URL Injection via Unsanitised lng/ns - CVE-2026-41691

You might also like:

Apache and Express Path Traversal plus Nginx Restriction Bypass Tests with SmartScanner

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

nitro