Nitro has an Open Redirect via Protocol-Relative URL Bypass in Wildcard Route Rules

Description

A redirect route rule like:

is intended to rewrite paths within the same host. Before the patch, an attacker could turn the rewrite into a cross-host redirect by sliding an extra slash in after the rule prefix. Example exploit:

Nitro stripped /legacy from the matched pathname and joined the remainder against the rule’s target.

Recommendation

Update the nitropack package to the latest compatible version. Followings are version details:

• Affected version(s): < 2.13.4
• Patched version(s): 2.13.4

References

• GHSA-9phm-9p8f-hw5m
• CVE-2026-44372
• CWE-601
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• Nitro has an Open Redirect via Protocol-Relative URL Bypass in Wildcard Route Rules - nitro - CVE-2026-44372
• Saltcorn: Open Redirect in `POST /auth/login` due to incomplete `is_relative_url` validation (backslash bypass) - CVE-2026-42259
• Nitro has a proxy scope bypass via percent-encoded path traversal in `routeRules` - CVE-2026-44373
• Waku has an Open Redirect via `unstable_redirect` Helper - CVE-2026-49456

You might also like:

Apache and Express Path Traversal plus Nginx Restriction Bypass Tests with SmartScanner

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

nitropack