Description
A redirect route rule like:
is intended to rewrite paths within the same host. Before the patch, an attacker could turn the rewrite into a cross-host redirect by sliding an extra slash in after the rule prefix. Example exploit:
Nitro stripped /legacy from the matched pathname and joined the remainder against the rule’s target.
Recommendation
Update the nitropack package to the latest compatible version. Followings are version details:
- Affected version(s): < 2.13.4
- Patched version(s): 2.13.4
References
Could your website be exposed too?
SmartScanner can check your website for Nitro has an Open Redirect via Protocol-Relative URL Bypass in Wildcard Route Rules and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Nitro has an Open Redirect via Protocol-Relative URL Bypass in Wildcard Route Rules - nitro - CVE-2026-44372
- Saltcorn: Open Redirect in `POST /auth/login` due to incomplete `is_relative_url` validation (backslash bypass) - CVE-2026-42259
- Nitro has a proxy scope bypass via percent-encoded path traversal in `routeRules` - CVE-2026-44373
- Waku has an Open Redirect via `unstable_redirect` Helper - CVE-2026-49456
You might also like:
See something that needs correcting? Let us knowUpdated June 09, 2026