CVE-2026-44372

Published May 13th, 2026

View on NVD ↗

CVSS v3

6.1

MEDIUM

CVSS v2

N/A

Affected

PROJECT

Description

Nitro is a next generation server toolkit. Prior to 3.0.260429-beta, an attacker could turn a redirect route rule using wildcards rewrite into a cross-host redirect by sliding an extra slash in after the rule prefix. This vulnerability is fixed in 3.0.260429-beta.

nitrojs/nitro

Next Generation Server Toolkit. Create web servers with everything you need and deploy them wherever you prefer.

GitHub

10.9K