Executive brief
Nitro, a web server framework, contains a vulnerability that allows attackers to redirect users from a legitimate website to a malicious one. By manipulating a specific type of web address rule, an attacker can trick the server into sending users to an external site while the initial link appears to belong to the trusted domain. This can be used in phishing attacks to steal user credentials or distribute malware.
Technical details
An open redirect vulnerability exists in Nitro's 'routeRules' when using wildcard suffixes (e.g., '/**'). The vulnerability is caused by improper handling of leading slashes in the matched pathname. When an attacker provides a path with an extra slash (e.g., '/legacy//evil.com'), Nitro's runtime strips the prefix but preserves the double slash, resulting in a protocol-relative URL (//evil.com). Browsers resolve this as a redirect to an external host. This affects deployments using the Nitro runtime but excludes those handled at the CDN layer (like Vercel or Cloudflare Pages). The fix involves updating the 'ufo' dependency to 1.6.4+ and patching the Nitro runtime to collapse leading slashes.
Affected products
- unjs nitro < 3.0.260429-beta
- unjs nitropack < 2.13.4
Timeline
- 2026-04-29: patched: Initial patch released in beta and stable branches
- 2026-05-06: disclosed: GitHub Advisory published
- 2026-05-13: advisory: NVD published CVE-2026-44372