CVE-2026-44372

MediumCVSS 6.1

Published: 13/05/2026(UTC)Updated: 26/10/2026(UTC)Translated: 26/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.28%

20th percentile - higher than 20% of all known CVEs

Summary

Nitro prior to 3.0.260429-beta allows an attacker to turn a wildcard redirect route rule into a cross-host redirect by sliding an extra slash after the rule prefix. This vulnerability is fixed in 3.0.260429-beta.

Risk Assessment

An attacker could redirect users to malicious sites, potentially leading to phishing or credential theft.

Recommendation

Upgrade Nitro to version 3.0.260429-beta or later, which fixes this vulnerability. Immediate patching is recommended.

Other vulnerabilities in Nitro

CVE-2026-44373Medium
Nitro is a next generation server toolkit. Prior to 3.0.260429-beta, an attacker could bypass a proxy route rule by sending percent-encoded path traversal (..%2f) in the URL, causing Nitro to forward a request that the upstream resolved outside the configured scope.

Original NVD description (English source)

Nitro is a next generation server toolkit. Prior to 3.0.260429-beta, an attacker could turn a redirect route rule using wildcards rewrite into a cross-host redirect by sliding an extra slash in after the rule prefix. This vulnerability is fixed in 3.0.260429-beta.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS