Approved changes feed: RSS · Atom
cpe:2.3:a:nitrojs:nitro:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Nitrojs (970aa594-3350-55c6-9467-7beb1a8b8e63) |
|---|---|
| Product | Nitro (2bd5a2f2-f1e0-50b4-9541-15373e9356bb) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-44373 |
vulnerable | 2026-06-08 08:05:11.004472 |
Nitro: Proxy scope bypass via percent-encoded path traversal in `routeRules`
MEDIUM (5.3)
Nitro is a next generation server toolkit. Prior to 3.0.260429-beta, an attacker could bypass a proxy route rule by sending percent-encoded path traversal (..%2f) in the URL, causing Nitro to forward a request that the upstream resolved outside the configured scope. This vulnerability is fixed in 3.0.260429-beta.
Published: 2026-05-13T20:26:28.255Z
Updated: 2026-05-14T13:16:50.542Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-44372 |
vulnerable | 2026-06-08 08:05:11.003061 |
Nitro: Open Redirect via Protocol-Relative URL Bypass in Wildcard Route Rules
Nitro is a next generation server toolkit. Prior to 3.0.260429-beta, an attacker could turn a redirect route rule using wildcards rewrite into a cross-host redirect by sliding an extra slash in after the rule prefix. This vulnerability is fixed in 3.0.260429-beta.
Published: 2026-05-13T20:30:44.943Z
Updated: 2026-05-14T15:47:06.216Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.