npm/nitropack CVE-2026-44372: medium 6.1, EPSS 0.38%
Nitro has an Open Redirect via Protocol-Relative URL Bypass in Wildcard Route Rules
Action: Upgrade nitropack to 2.13.4 or later.
npm i nitropack@2.13.4Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.13.4 | - |
Fixed versions
| 2.13.4 |
Sources
- osv: GHSA-9phm-9p8f-hw5m#npm/nitropack
- https://github.com/nitrojs/nitro/security/advisories/GHSA-9phm-9p8f-hw5m
- https://nvd.nist.gov/vuln/detail/CVE-2026-44372
- https://github.com/nitrojs/nitro/pull/4236
- https://github.com/unjs/ufo/commit/5cd9e676711af3f4e4b5398ddf6ca8d52c1c7e1f
- https://github.com/nitrojs/nitro
- https://github.com/nitrojs/nitro/releases/tag/v2.13.4
- https://github.com/nitrojs/nitro/releases/tag/v3.0.260429-beta
CVE-2026-44372 · published · modified · JSON