CVE-2026-44373: Nitro proxy route rule bypass via percent-encoded path traversal

CVE-2026-44373 · Severity: medium · CVSS 5.3 · Published 2026-05-13

Nitro is a server toolkit used to build and deploy web applications. A flaw in its proxy routing rules allows attackers to bypass intended access scopes by using percent-encoded path traversal sequences in URLs. An attacker could potentially access restricted internal endpoints, admin panels, or other services that should be protected by the scope rules, depending on how the upstream server decodes URLs.

Technologies: UnJS NitroPack. Vendors: npm, UnJS.

Quick answers

Is CVE-2026-44373 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-44373 being exploited in the wild.
How severe is CVE-2026-44373?
Medium severity, with a CVSS score of 5.3, published 13 May 2026.
Which products and versions are affected?
nitro (npm) SEMVER:introduced=0,fixed=3.0.260429-beta; nitropack (npm) SEMVER:introduced=0,fixed=2.13.4; UnJS Nitro < 2.13.4, < 3.0.260429-beta, < 3.0.260429-beta; UnJS NitroPack < 2.13.4.
Is there a fix for CVE-2026-44373?
Yes. nitro (npm): upgrade to 3.0.260429-beta or later; nitropack (npm): upgrade to 2.13.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44373 attacked?
It is attacked over the network.
Am I affected by CVE-2026-44373?
Check whether you run nitro (npm), nitropack (npm), UnJS Nitro or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • nitro (npm): upgrade to 3.0.260429-beta or later
    npm install nitro@3.0.260429-beta
  • nitropack (npm): upgrade to 2.13.4 or later
    npm install nitropack@2.13.4

Technical details

The vulnerability is a path traversal flaw in Nitro's routeRules handling when proxy directives with wildcard suffixes (/**) are configured. When matching incoming URLs, Nitro does not canonicalize percent-encoded sequences before evaluating the route scope. An attacker can send a request like GET /api/orders/..%2fadmin%2fconfig.json; Nitro sees %2f as opaque and matches it against the /api/orders/** rule, then forwards the raw path to the upstream service. If the upstream decodes %2F to / before routing or filesystem access, path traversal occurs and the attacker reaches /admin/config.json outside the intended scope. The attack requires: (1) Nitro configured with proxy rules using /** wildcards, (2) an upstream that decodes percent-encoded forward slashes, and (3) network access to the Nitro server. The fix, released in Nitro v2.13.4 and v3.0.260429-beta or later, canonicalizes paths before URL construction and rejects requests with a 400 Bad Request if the resolved path escapes the rule's base.

Affected products

  • Nitro nitro < 3.0.260429-beta
  • Nitro nitropack < 2.13.4

Identifiers

  • CVE-2026-44373
  • GHSA-5w89-w975-hf9q

Timeline

  • 2026-05-06: disclosed: GHSA-5w89-w975-hf9q published
  • 2026-04-29: patched: v2.13.4 and v3.0.260429-beta released with fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.