CVE-2026-44372CWE-601

Nitro: Open Redirect via Protocol-Relative URL Bypass in Wildcard Route Rules

Medium · published May 13, 2026

CVSS v4.0
5.3
EPSS
0%
Percentile
30.5
In the wild
Unconfirmed
What it is

Nitro is a next generation server toolkit. Prior to 3.0.260429-beta, an attacker could turn a redirect route rule using wildcards rewrite into a cross-host redirect by sliding an extra slash in after the rule prefix. This vulnerability is fixed in 3.0.260429-beta.

The record
Technical detail
CVSS v4.0
5.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
EPSS
0.00377 · 30.5th percentile
Weakness
CWE-601 · URL Redirection to Untrusted Site ('Open Redirect')
Published
2026-05-13T20:30Z
EPSS history
Timeline
  • 13 MAY 20:30Z
    Nitro: Open Redirect via Protocol-Relative URL Bypass in Wildcard Route Rules
    cvelistv5