nitrojs/nitro

nitrojs/nitro

GitHubGitHub
GitHubgithub.com
nitro.buildnitro.build
Releases150
Frequency1 week 3 days
Last Release
Stars11K
Next Generation Server Toolkit. Create web servers with everything you need and deploy them wherever you prefer.
Log in to subscribe

CVE History

CVEAffectedPublishedCVSS v3CVSS v2
CVE-2026-44373NVD↗
< 2.13.4, > 2.13.4, < 3.0.260429, < 3.0.260429-beta5.3 MEDIUM—

Nitro is a next generation server toolkit. Prior to 3.0.260429-beta, an attacker could bypass a proxy route rule by sending percent-encoded path traversal (..%2f) in the URL, causing Nitro to forward a request that the upstream resolved outside the configured scope. This vulnerability is fixed in 3.0.260429-beta.

CVE-2026-44372NVD↗
< 2.13.4, > 2.13.4, < 3.0.260429, < 3.0.260429-beta6.1 MEDIUM—

Nitro is a next generation server toolkit. Prior to 3.0.260429-beta, an attacker could turn a redirect route rule using wildcards rewrite into a cross-host redirect by sliding an extra slash in after the rule prefix. This vulnerability is fixed in 3.0.260429-beta.