{"id":"EUVD-2026-30163","enisaUuid":"546354e6-1ddc-3ece-aaac-b9ce91b8f834","description":"Nitro is a next generation server toolkit. Prior to 3.0.260429-beta, an attacker could bypass a proxy route rule by sending percent-encoded path traversal (..%2f) in the URL, causing Nitro to forward a request that the upstream resolved outside the configured scope. This vulnerability is fixed in 3.0.260429-beta.","datePublished":"May 13, 2026, 8:26:28 PM","dateUpdated":"May 14, 2026, 1:16:50 PM","baseScore":5.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","references":"https://github.com/nitrojs/nitro/security/advisories/GHSA-5w89-w975-hf9q\nhttps://github.com/nitrojs/nitro/pull/4222\nhttps://github.com/nitrojs/nitro/pull/4223\nhttps://github.com/nitrojs/nitro/releases/tag/v2.13.4\nhttps://github.com/nitrojs/nitro/releases/tag/v3.0.260429-beta\n","aliases":"CVE-2026-44373\nGHSA-5w89-w975-hf9q\n","assigner":"GitHub_M","epss":0.45,"enisaIdProduct":[{"id":"b7d68c6d-f674-3f69-8cf0-616c279361ad","product":{"name":"NitroPack","vendor":{"name":"nitrojs"}},"product_version":"\u003c 2.13.4"},{"id":"e2f833e6-b96e-3e4f-b065-93f5cd8ec71e","product":{"name":"nitro","vendor":{"name":"nitrojs"}},"product_version":"\u003c 3.0.260429-beta"}],"enisaIdVendor":[{"id":"ad064774-52ed-3403-90da-4c5ec5288102","vendor":{"name":"nitrojs"}}],"enisaIdVulnerability":[{"id":"a2ad64fe-2889-37b3-a643-3d7c62e52244","vulnerability":{"id":"GHSA-5w89-w975-hf9q","description":"Nitro has a proxy scope bypass via percent-encoded path traversal in `routeRules`","datePublished":"May 6, 2026, 11:01:27 PM","dateUpdated":"May 14, 2026, 8:42:49 PM","baseScore":0.0,"references":"https://github.com/nitrojs/nitro/security/advisories/GHSA-5w89-w975-hf9q\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-44373\nhttps://github.com/nitrojs/nitro/pull/4222\nhttps://github.com/nitrojs/nitro/pull/4223\nhttps://github.com/nitrojs/nitro\nhttps://github.com/nitrojs/nitro/releases/tag/v2.13.4\nhttps://github.com/nitrojs/nitro/releases/tag/v3.0.260429-beta\n","enisa_id":"EUVD-2026-30163\n","aliases":"CVE-2026-44373\nGHSA-5w89-w975-hf9q\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:00:21 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"cd6b1e0b-767b-3a6e-9aa3-807b3cd4d38e","vulnerability":{"id":"CVE-2026-44373","description":"Nitro is a next generation server toolkit. Prior to 3.0.260429-beta, an attacker could bypass a proxy route rule by sending percent-encoded path traversal (..%2f) in the URL, causing Nitro to forward a request that the upstream resolved outside the configured scope. This vulnerability is fixed in 3.0.260429-beta.","datePublished":"May 13, 2026, 8:26:28 PM","dateUpdated":"May 14, 2026, 1:16:50 PM","status":"PUBLISHED","baseScore":5.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","references":"https://github.com/nitrojs/nitro/security/advisories/GHSA-5w89-w975-hf9q\nhttps://github.com/nitrojs/nitro/pull/4222\nhttps://github.com/nitrojs/nitro/pull/4223\nhttps://github.com/nitrojs/nitro/releases/tag/v2.13.4\nhttps://github.com/nitrojs/nitro/releases/tag/v3.0.260429-beta\n","enisa_id":"EUVD-2026-30163\n","assigner":"GitHub_M","epss":0.45,"dataProcessed":"Nov 7, 2026, 7:21:46 AM","vulnerabilityProduct":[{"id":"48073aae-11f6-35b3-b014-3d1bb1bad239","product":{"name":"NitroPack","vendor":{"name":"nitrojs"}},"product_version":"\u003c 2.13.4"},{"id":"e57e18f7-e512-3694-bd7f-e60e599051c4","product":{"name":"nitro","vendor":{"name":"nitrojs"}},"product_version":"\u003c 3.0.260429-beta"}],"vulnerabilityVendor":[{"id":"aefbd9f9-93b3-3278-8d6d-713a03dc5e01","vendor":{"name":"nitrojs"}}]}}],"enisaIdAdvisory":[]}