CVE-2026-44373 Details
Description
Nitro is a next generation server toolkit. Prior to 3.0.260429-beta, an attacker could bypass a proxy route rule by sending percent-encoded path traversal (..%2f) in the URL, causing Nitro to forward a request that the upstream resolved outside the configured scope. This vulnerability is fixed in 3.0.260429-beta.
A vulnerability in Nitro, a server toolkit, prior to version 3.0.260429-beta, allows attackers to bypass proxy route rules by sending percent-encoded path traversal sequences in the URL. This manipulation causes Nitro to forward requests that the upstream server resolves outside the intended scope, potentially exposing sensitive endpoints or data.
Upgrade to Nitro version 3.0.260429-beta or 2.13.4. The fix canonicalizes the incoming pathname before building the upstream URL and rejects out-of-scope requests with a 400 Bad Request response.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/nitrojs/nitro/pull/4222 | [email protected] | Issue TrackingPatch |
| https://github.com/nitrojs/nitro/pull/4223 | [email protected] | Issue TrackingPatch |
| https://github.com/nitrojs/nitro/releases/tag/v2.13.4 | [email protected] | Release Notes |
| https://github.com/nitrojs/nitro/releases/tag/v3.0.260429-beta | [email protected] | Release Notes |
| https://github.com/nitrojs/nitro/security/advisories/GHSA-5w89-w975-hf9q | [email protected] | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| nitro nitro | < 2.13.4 > 2.13.4, < 3.0.260429 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 28, 2026 | Initial Analysis | [email protected] |
| May 13, 2026 | New CVE Received | [email protected] |