CVE-2026-44372

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-44372", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-05T20:15:20.631Z", "datePublished": "2026-05-13T20:30:44.943Z", "dateUpdated": "2026-05-14T15:47:06.216Z"}, "containers": {"cna": {"title": "Nitro: Open Redirect via Protocol-Relative URL Bypass in Wildcard Route Rules", "problemTypes": [{"descriptions": [{"cweId": "CWE-601", "lang": "en", "description": "CWE-601: URL Redirection to Untrusted Site ('Open Redirect')", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/nitrojs/nitro/security/advisories/GHSA-9phm-9p8f-hw5m", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/nitrojs/nitro/security/advisories/GHSA-9phm-9p8f-hw5m"}, {"name": "https://github.com/nitrojs/nitro/pull/4236", "tags": ["x_refsource_MISC"], "url": "https://github.com/nitrojs/nitro/pull/4236"}, {"name": "https://github.com/nitrojs/nitro/releases/tag/v2.13.4", "tags": ["x_refsource_MISC"], "url": "https://github.com/nitrojs/nitro/releases/tag/v2.13.4"}, {"name": "https://github.com/nitrojs/nitro/releases/tag/v3.0.260429-beta", "tags": ["x_refsource_MISC"], "url": "https://github.com/nitrojs/nitro/releases/tag/v3.0.260429-beta"}], "affected": [{"vendor": "nitrojs", "product": "nitro", "versions": [{"version": "< 3.0.260429-beta", "status": "affected"}]}, {"vendor": "nitrojs", "product": "nitropack", "versions": [{"version": "< 2.13.4", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-13T20:30:44.943Z"}, "descriptions": [{"lang": "en", "value": "Nitro is a next generation server toolkit. Prior to 3.0.260429-beta, an attacker could turn a redirect route rule using wildcards rewrite into a cross-host redirect by sliding an extra slash in after the rule prefix. This vulnerability is fixed in 3.0.260429-beta."}], "source": {"advisory": "GHSA-9phm-9p8f-hw5m", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-14T15:46:57.649072Z", "id": "CVE-2026-44372", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-14T15:47:06.216Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-44372", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-05-14T15:46:57.649072Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-14T15:47:02.967Z"}}], "cna": {"title": "Nitro: Open Redirect via Protocol-Relative URL Bypass in Wildcard Route Rules", "source": {"advisory": "GHSA-9phm-9p8f-hw5m", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "nitrojs", "product": "nitro", "versions": [{"status": "affected", "version": "< 3.0.260429-beta"}]}, {"vendor": "nitrojs", "product": "nitropack", "versions": [{"status": "affected", "version": "< 2.13.4"}]}], "references": [{"url": "https://github.com/nitrojs/nitro/security/advisories/GHSA-9phm-9p8f-hw5m", "name": "https://github.com/nitrojs/nitro/security/advisories/GHSA-9phm-9p8f-hw5m", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/nitrojs/nitro/pull/4236", "name": "https://github.com/nitrojs/nitro/pull/4236", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/nitrojs/nitro/releases/tag/v2.13.4", "name": "https://github.com/nitrojs/nitro/releases/tag/v2.13.4", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/nitrojs/nitro/releases/tag/v3.0.260429-beta", "name": "https://github.com/nitrojs/nitro/releases/tag/v3.0.260429-beta", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Nitro is a next generation server toolkit. Prior to 3.0.260429-beta, an attacker could turn a redirect route rule using wildcards rewrite into a cross-host redirect by sliding an extra slash in after the rule prefix. This vulnerability is fixed in 3.0.260429-beta."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-601", "description": "CWE-601: URL Redirection to Untrusted Site ('Open Redirect')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-13T20:30:44.943Z"}}}, "cveMetadata": {"cveId": "CVE-2026-44372", "state": "PUBLISHED", "dateUpdated": "2026-05-14T15:47:06.216Z", "dateReserved": "2026-05-05T20:15:20.631Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-05-13T20:30:44.943Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "nitro", "vendor": "nitrojs", "versions": [{"status": "affected", "version": "< 3.0.260429-beta"}]}, {"product": "nitropack", "vendor": "nitrojs", "versions": [{"status": "affected", "version": "< 2.13.4"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:nitro:nitro:*:*:*:*:*:*:*:*", "matchCriteriaId": "4184D77E-DD83-4720-ADE4-08D6DE54CFC2", "versionEndExcluding": "2.13.4", "vulnerable": true}, {"criteria": "cpe:2.3:a:nitro:nitro:*:*:*:*:*:*:*:*", "matchCriteriaId": "B7044A13-4A34-453D-AEDD-537368D23865", "versionEndExcluding": "3.0.260429", "versionStartExcluding": "2.13.4", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Nitro is a next generation server toolkit. Prior to 3.0.260429-beta, an attacker could turn a redirect route rule using wildcards rewrite into a cross-host redirect by sliding an extra slash in after the rule prefix. This vulnerability is fixed in 3.0.260429-beta."}, {"lang": "es", "value": "Nitro es un kit de herramientas de servidor de pr\u00f3xima generaci\u00f3n. Antes de 3.0.260429-beta, un atacante podr\u00eda convertir una regla de ruta de redirecci\u00f3n que utiliza la reescritura de comodines en una redirecci\u00f3n entre hosts deslizando una barra adicional despu\u00e9s del prefijo de la regla. Esta vulnerabilidad est\u00e1 corregida en 3.0.260429-beta."}], "id": "CVE-2026-44372", "lastModified": "2026-10-26T14:10:00.130", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44372", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-05-14T15:46:57.649072Z", "version": "2.0.3"}}]}, "published": "2026-05-13T21:16:47.890", "references": [{"source": "security-advisories@github.com", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/nitrojs/nitro/pull/4236"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/nitrojs/nitro/releases/tag/v2.13.4"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/nitrojs/nitro/releases/tag/v3.0.260429-beta"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/nitrojs/nitro/security/advisories/GHSA-9phm-9p8f-hw5m"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-601"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,3.0.260429-beta)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "nitro", "source": "cna", "vendor": "nitrojs"}, "product": "nitro", "vendor": "nitrojs"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.13.4)"}}], "enrichment": {"confidence": 83.0, "confidence_source": "matching", "scores": [{"score": 83.0, "source": "matching"}]}, "original": {"product": "nitropack", "source": "cna", "vendor": "nitrojs"}, "product": "nitropack", "vendor": "nitropack"}], "created": "2026-05-13T23:15:08.093111+00:00", "updated": "2026-05-14T14:33:28.835931+00:00", "vendors": ["nitrojs", "nitrojs$PRODUCT$nitro", "nitropack", "nitropack$PRODUCT$nitropack"]}