CVE-2026-44373

Name: CVE-2026-44373
Creator: NVD / NIST
Published: 2026-05-13T21:16:48.033+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

MEDIUMCVSS 5.3/10EPSS 0.39%

Last modified Jun 17, 2026

CVE-2026-44373 is a medium-severity vulnerability rated 5.3/10 on the CVSS scale. Nitro is a next generation server toolkit. Prior to 3.0.260429-beta, an attacker could bypass a proxy route rule by sending percent-encoded path traversal (..%2f) in the URL, causing Nitro to forward a request that the upstream resolved outside the configured scope. EPSS estimates a 0.39% chance of exploitation in the next 30 days.

Description

Nitro is a next generation server toolkit. Prior to 3.0.260429-beta, an attacker could bypass a proxy route rule by sending percent-encoded path traversal (..%2f) in the URL, causing Nitro to forward a request that the upstream resolved outside the configured scope. This vulnerability is fixed in 3.0.260429-beta.

Metrics

CVSS 3.1

5.3/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS Probability

0.39%

31.0th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-22

Affected Software

Vendor	Product	Versions
Nitro	Nitro	< 2.13.4
Nitro	Nitro	> 2.13.4, < 3.0.260429

References

https://github.com/nitrojs/nitro/pull/4222Issue Tracking, Patch
https://github.com/nitrojs/nitro/pull/4223Issue Tracking, Patch
https://github.com/nitrojs/nitro/releases/tag/v2.13.4Release Notes
https://github.com/nitrojs/nitro/releases/tag/v3.0.260429-betaRelease Notes
https://github.com/nitrojs/nitro/security/advisories/GHSA-5w89-w975-hf9qThird Party Advisory

Timeline

Published: May 13, 2026
Last Modified: Jun 17, 2026
Status: Analyzed

Frequently Asked Questions

What is CVE-2026-44373?

How severe is CVE-2026-44373?

CVE-2026-44373 has a CVSS score of 5.3/10 (MEDIUM severity). The EPSS model estimates a 0.39% probability of exploitation in the next 30 days.

How do I fix CVE-2026-44373?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2026-44373?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST