{"id":"EUVD-2026-30162","enisaUuid":"06b4b9e4-2d96-3734-8eeb-092467a62df0","description":"Nitro is a next generation server toolkit. Prior to 3.0.260429-beta, an attacker could turn a redirect route rule using wildcards rewrite into a cross-host redirect by sliding an extra slash in after the rule prefix. This vulnerability is fixed in 3.0.260429-beta.","datePublished":"May 13, 2026, 8:30:44 PM","dateUpdated":"May 14, 2026, 3:47:06 PM","baseScore":5.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","references":"https://github.com/nitrojs/nitro/security/advisories/GHSA-9phm-9p8f-hw5m\nhttps://github.com/nitrojs/nitro/pull/4236\nhttps://github.com/nitrojs/nitro/releases/tag/v2.13.4\nhttps://github.com/nitrojs/nitro/releases/tag/v3.0.260429-beta\n","aliases":"CVE-2026-44372\nGHSA-9phm-9p8f-hw5m\n","assigner":"GitHub_M","epss":0.28,"enisaIdProduct":[{"id":"443e1b33-b743-3502-97c4-e8fb0cf58a31","product":{"name":"NitroPack","vendor":{"name":"nitrojs"}},"product_version":"\u003c 2.13.4"},{"id":"7bcc21ab-039a-3690-ad03-ae92f379d97d","product":{"name":"nitro","vendor":{"name":"nitrojs"}},"product_version":"\u003c 3.0.260429-beta"}],"enisaIdVendor":[{"id":"de1d7b2a-d433-3b59-95f7-564a9d41ef5f","vendor":{"name":"nitrojs"}}],"enisaIdVulnerability":[{"id":"50e14b3e-fcfd-32d9-9097-727b4f47771f","vulnerability":{"id":"CVE-2026-44372","description":"Nitro is a next generation server toolkit. Prior to 3.0.260429-beta, an attacker could turn a redirect route rule using wildcards rewrite into a cross-host redirect by sliding an extra slash in after the rule prefix. This vulnerability is fixed in 3.0.260429-beta.","datePublished":"May 13, 2026, 8:30:44 PM","dateUpdated":"May 14, 2026, 3:47:06 PM","status":"PUBLISHED","baseScore":5.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","references":"https://github.com/nitrojs/nitro/security/advisories/GHSA-9phm-9p8f-hw5m\nhttps://github.com/nitrojs/nitro/pull/4236\nhttps://github.com/nitrojs/nitro/releases/tag/v2.13.4\nhttps://github.com/nitrojs/nitro/releases/tag/v3.0.260429-beta\n","enisa_id":"EUVD-2026-30162\n","assigner":"GitHub_M","epss":0.28,"dataProcessed":"Oct 28, 2026, 7:17:27 AM","vulnerabilityProduct":[{"id":"46867288-0295-3b03-878f-227aa104fc16","product":{"name":"NitroPack","vendor":{"name":"nitrojs"}},"product_version":"\u003c 2.13.4"},{"id":"96dda588-a401-3348-97a2-af943a8150d5","product":{"name":"nitro","vendor":{"name":"nitrojs"}},"product_version":"\u003c 3.0.260429-beta"}],"vulnerabilityVendor":[{"id":"5257e94e-d25c-3816-8f56-6f0b15df67ee","vendor":{"name":"nitrojs"}}]}},{"id":"6de655c0-fbcc-3f6d-b14c-1823f6550fae","vulnerability":{"id":"GHSA-9phm-9p8f-hw5m","description":"Nitro has an Open Redirect via Protocol-Relative URL Bypass in Wildcard Route Rules","datePublished":"May 6, 2026, 11:02:45 PM","dateUpdated":"Jun 9, 2026, 1:58:50 AM","baseScore":0.0,"references":"https://github.com/nitrojs/nitro/security/advisories/GHSA-9phm-9p8f-hw5m\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-44372\nhttps://github.com/nitrojs/nitro/pull/4236\nhttps://github.com/unjs/ufo/commit/5cd9e676711af3f4e4b5398ddf6ca8d52c1c7e1f\nhttps://github.com/nitrojs/nitro\nhttps://github.com/nitrojs/nitro/releases/tag/v2.13.4\nhttps://github.com/nitrojs/nitro/releases/tag/v3.0.260429-beta\n","enisa_id":"EUVD-2026-30162\n","aliases":"CVE-2026-44372\nGHSA-9phm-9p8f-hw5m\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:55:50 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}