CVE-2026-44372 Overview
CVE-2026-44372 is an open redirect vulnerability [CWE-601] in Nitro, a server toolkit used to build web applications and APIs. Versions prior to 3.0.260429-beta improperly handle wildcard rewrite rules in redirect route configurations. An attacker can append an extra slash after the rule prefix to transform an intended same-host redirect into a cross-host redirect. The flaw enables phishing and credential theft scenarios by redirecting users to attacker-controlled domains while preserving the trusted origin in initial links. The maintainers fixed the issue in version 3.0.260429-beta.
Critical Impact
Attackers can redirect victims from a trusted Nitro-powered application to an arbitrary external host, enabling phishing campaigns and credential harvesting via abuse of wildcard rewrite redirect rules.
Affected Products
- Nitro server toolkit versions prior to 3.0.260429-beta
- Applications using Nitro redirect route rules with wildcard rewrites
- Downstream frameworks built on vulnerable Nitro releases
Discovery Timeline
- 2026-05-13 - CVE-2026-44372 published to NVD
- 2026-05-13 - Last updated in NVD database
Technical Details for CVE-2026-44372
Vulnerability Analysis
The vulnerability resides in Nitro's redirect route rule handler when wildcards are used to rewrite incoming paths. Nitro allows developers to configure route rules that match a prefix and rewrite the request to a redirect target. When the rule uses wildcards to forward path segments to the rewrite target, the matching logic does not adequately normalize the suffix portion of the incoming URL.
An attacker can craft a URL that places an additional slash immediately after the configured prefix. The wildcard capture then contains a value that begins with a slash, which the rewrite logic concatenates into the redirect target. The resulting Location header points to a host the developer never intended to allow. This pattern matches the open redirect class tracked under [CWE-601].
Root Cause
The root cause is insufficient validation of the captured wildcard segment before it is substituted into the redirect destination. URL parsers interpret strings beginning with // as protocol-relative references, treating the next path component as the authority. By inserting an extra slash, the attacker promotes user-controlled path data into the host position of the resulting redirect URL.
Attack Vector
Exploitation requires the target application to define a redirect route rule that uses wildcard rewrites. The attacker distributes a link to the legitimate Nitro application that includes the crafted extra slash and an attacker-controlled host in the path. When a victim clicks the link, the application issues an HTTP redirect to the attacker's domain. User interaction is required because the victim must follow the link. See the GitHub Security Advisory GHSA-9phm-9p8f-hw5m for technical details.
Detection Methods for CVE-2026-44372
Indicators of Compromise
- HTTP request URIs containing double slashes (//) immediately after a known redirect route prefix in access logs.
- Outbound Location response headers pointing to external hosts from endpoints that should redirect internally.
- Spikes in 30x responses from Nitro applications correlated with referrals to unfamiliar external domains.
Detection Strategies
- Inventory all Nitro-based services and identify those running versions earlier than 3.0.260429-beta.
- Review nitro.config or routeRules definitions for redirect entries that use wildcard rewrites.
- Parse web server logs for request paths matching configured redirect prefixes followed by an extra / and a hostname-like segment.
Monitoring Recommendations
- Alert on redirect responses whose Location header host does not match an allow-listed set of internal or partner domains.
- Forward web access and application logs to a centralized analytics platform to baseline redirect destinations.
- Add web application firewall rules that flag // sequences appearing after known Nitro redirect prefixes.
How to Mitigate CVE-2026-44372
Immediate Actions Required
- Upgrade Nitro to version 3.0.260429-beta or later across all affected applications.
- Audit all redirect route rules that use wildcards and confirm rewrite targets cannot be influenced by user input.
- Notify development teams consuming Nitro through downstream frameworks to verify their resolved dependency version.
Patch Information
The issue is fixed in Nitro 3.0.260429-beta as documented in GitHub Release v3.0.260429-beta. Related changes are tracked in GitHub Pull Request #4236, and a parallel maintenance release is available at GitHub Release v2.13.4. Refer to the GitHub Security Advisory GHSA-9phm-9p8f-hw5m for full remediation guidance.
Workarounds
- Remove wildcard rewrites from redirect route rules until the upgrade is deployed.
- Validate the final redirect target against an allow list of trusted hosts before responding with a Location header.
- Normalize incoming request paths to collapse repeated slashes before the redirect rule is evaluated.
# Configuration example
npm install nitropack@3.0.260429-beta
# or for the v2 maintenance line
npm install nitropack@2.13.4
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
