Nitro has an Open Redirect via Protocol-Relative URL Bypass in Wildcard Route Rules - nitro

Description

A redirect route rule like:

is intended to rewrite paths within the same host. Before the patch, an attacker could turn the rewrite into a cross-host redirect by sliding an extra slash in after the rule prefix. Example exploit:

Nitro stripped /legacy from the matched pathname and joined the remainder against the rule’s target.

Recommendation

Update the nitro package to the latest compatible version. Followings are version details:

• Affected version(s): < 3.0.260429-beta
• Patched version(s): 3.0.260429-beta

References

• GHSA-9phm-9p8f-hw5m
• CVE-2026-44372
• CWE-601
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• Nitro has an Open Redirect via Protocol-Relative URL Bypass in Wildcard Route Rules - CVE-2026-44372
• Saltcorn: Open Redirect in `POST /auth/login` due to incomplete `is_relative_url` validation (backslash bypass) - CVE-2026-42259
• Waku has an Open Redirect via `unstable_redirect` Helper - CVE-2026-49456
• @workos/authkit-session has an Open Redirect via state-derived redirect target - CVE-2026-42565

You might also like:

Apache and Express Path Traversal plus Nginx Restriction Bypass Tests with SmartScanner

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

nitro