mrousavy/nitro

mrousavy/nitro

nitro.margelo.com

Releases119

Frequency6 days 8 hours

Last Release15 days ago

Stars1.88K

🔥 Insanely fast native C++, Swift or Kotlin modules with a statically compiled binding layer to JSI

Log in to subscribe

CVE History

CVE	Affected	Published	CVSS v3	CVSS v2
CVE-2026-44373NVD↗	< 2.13.4, > 2.13.4, < 3.0.260429	May 13, 2026Wednesday, 13 May 2026, 21:16	5.3 MEDIUM	—
Nitro is a next generation server toolkit. Prior to 3.0.260429-beta, an attacker could bypass a proxy route rule by sending percent-encoded path traversal (..%2f) in the URL, causing Nitro to forward a request that the upstream resolved outside the configured scope. This vulnerability is fixed in 3.0.260429-beta.
CVE-2026-44372NVD↗	< 2.13.4, > 2.13.4, < 3.0.260429	May 13, 2026Wednesday, 13 May 2026, 21:16	6.1 MEDIUM	—
Nitro is a next generation server toolkit. Prior to 3.0.260429-beta, an attacker could turn a redirect route rule using wildcards rewrite into a cross-host redirect by sliding an extra slash in after the rule prefix. This vulnerability is fixed in 3.0.260429-beta.