Description
A proxy route rule like:
is intended to limit the proxy to URLs under /api/orders/. Before the patch, an attacker could bypass that scope by sending percent-encoded path traversal (..%2f) in the URL, causing Nitro to forward a request that the upstream resolved outside the configured scope. Example exploit:
Nitro sees ..%2f as opaque characters at match time, the /api/orders/** rule matched, and the raw path was forwarded to the upstream as /orders/..%2fadmin/config.json.
Recommendation
Update the nitro package to the latest compatible version. Followings are version details:
- Affected version(s): < 3.0.260429-beta
- Patched version(s): 3.0.260429-beta
References
Could your website be exposed too?
SmartScanner can check your website for Nitro has a proxy scope bypass via percent-encoded path traversal in `routeRules` - nitro and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Nitro has a proxy scope bypass via percent-encoded path traversal in `routeRules` - CVE-2026-44373
- fast-uri vulnerable to path traversal via percent-encoded dot segments - CVE-2026-6321
- Nitro has an Open Redirect via Protocol-Relative URL Bypass in Wildcard Route Rules - nitro - CVE-2026-44372
- i18next-http-backend has Path Traversal & URL Injection via Unsanitised lng/ns - CVE-2026-41691
You might also like:
See something that needs correcting? Let us knowUpdated May 14, 2026