Description
A redirect route rule like:
is intended to rewrite paths within the same host. Before the patch, an attacker could turn the rewrite into a cross-host redirect by sliding an extra slash in after the rule prefix. Example exploit:
Nitro stripped /legacy from the matched pathname and joined the remainder against the rule’s target.
Recommendation
Update the nitro package to the latest compatible version. Followings are version details:
- Affected version(s): < 3.0.260429-beta
- Patched version(s): 3.0.260429-beta
References
Could your website be exposed too?
SmartScanner can check your website for Nitro has an Open Redirect via Protocol-Relative URL Bypass in Wildcard Route Rules - nitro and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Nitro has an Open Redirect via Protocol-Relative URL Bypass in Wildcard Route Rules - CVE-2026-44372
- Saltcorn: Open Redirect in `POST /auth/login` due to incomplete `is_relative_url` validation (backslash bypass) - CVE-2026-42259
- Waku has an Open Redirect via `unstable_redirect` Helper - CVE-2026-49456
- @workos/authkit-session has an Open Redirect via state-derived redirect target - CVE-2026-42565
You might also like:
See something that needs correcting? Let us knowUpdated June 09, 2026