5.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-44372

CVE-2026-44372: Nitro: Open Redirect via Protocol-Relative URL Bypass in Wildcard Route Rules

Nitro is a next generation server toolkit. Prior to 3.0.260429-beta, an attacker could turn a redirect route rule using wildcards rewrite into a cross-host redirect by sliding an extra slash in after the rule prefix. This vulnerability is fixed in 3.0.260429-beta.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-44372

CVE-2026-44372:

5.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable YesTech Impact Total

Select your environment

→SSVCScheduled60 days

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
nitro	npm	< 3.0.260429-beta	3.0.260429-beta
nitropack	npm	< 2.13.4	2.13.4

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is an open redirect in Nitro's route rule handling, caused by improper processing of URL paths with double leading slashes (//). The issue has two main causes:

A flaw in the withoutBase function within the ufo dependency. When stripping a base path from a URL like /legacy//evil.com, the function would incorrectly return //evil.com. Browsers interpret this as a protocol-relative URL, leading to a redirect to an external, attacker-controlled domain (e.g., https://evil.com).
A logic error in Nitro's redirect and proxy rule handlers for the specific edge case of a /** wildcard rule. In this scenario, the withoutBase function was not used, and the raw path from the request was passed directly to construct the redirect/proxy URL. An attacker could send a request to //evil.com, and Nitro would generate a redirect to that same path, resulting in an open redirect.

The exploitation occurs within the event handlers created by the redirect and proxy functions located in src/runtime/internal/route-rules.ts. These handlers would either call the vulnerable ufo.withoutBase function or use the raw request path. The resulting malicious path would then be used to generate a Location header for a redirect or as the target for a proxy request. Consequently, withoutBase, redirect, and proxy are the key functions involved in this vulnerability. The fix involved patching ufo.withoutBase to correctly normalize leading slashes and adding a specific check in Nitro's runtime to handle the /** edge case.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.