CVE-2026-44373

Nitro is a next generation server toolkit. Prior to 3.0.260429-beta, an attacker could bypass a proxy route rule by sending percent-encoded path traversal ..%2f in the URL, causing Nitro to forward a request that the upstream resolved outside the configured scope. This vulnerability is fixed in...

@augu/fastify-nitro (>=1.0.0, <=1.2.0), @bicou/countries-server (>=1.5.0, <=1.6.7) +26 more potentially affected by CVE-2026-44373 via nitropack (>=2.1.0, <=2.13.1)

nitropack NPM version =2.1.0, =1.0.0, =1.5.0, =0.4.4, =0.6.1, =1.0.0, =1.0.0, =5.0.0-rc.212, =5.0.0-rc.212, =3.0.0, =4.0.0-alpha.1, =4.0.0-29145487.7beaa672, =7.40.3, =0.0.0-beta.0, =1.15.3, =1.31.24 and more Source cves: CVE-2026-44373 Source advisory: SNYK:JS-NITROPACK-16757953...

@100x/application (>=0.0.1, <=0.0.6), @aero-js/cli (0.4.0) +60 more potentially affected by CVE-2026-44373 via nitro (>=3.0.0, <=3.0.260415-beta)

nitro NPM version =3.0.0, =0.0.1, =0.3.3, =0.3.3, =0.3.3, =0.3.3, =0.3.3, =0.1.0, =0.1.0, =0.4.2, =0.2.9, =2.4.0-alpha.2, =3.0.0-alpha.55 and more Source cves: CVE-2026-44373 Source advisory: SNYK:JS-NITRO-16757954...

@100x/application (>=0.0.1, <=0.0.6), @aero-js/cli (0.4.0) +60 more potentially affected by CVE-2026-44373 via nitro (>=3.0.0, <=3.0.260415-beta)

nitro NPM version =3.0.0, =0.0.1, =0.3.3, =0.3.3, =0.3.3, =0.3.3, =0.3.3, =0.1.0, =0.1.0, =0.4.2, =0.2.9, =2.4.0-alpha.2, =3.0.0-alpha.55 and more Source cves: CVE-2026-44373 Source advisory: OSV:GHSA-5W89-W975-HF9Q...

@augu/fastify-nitro (>=1.0.0, <=1.2.0), @bicou/countries-server (>=1.5.0, <=1.6.7) +26 more potentially affected by CVE-2026-44373 via nitropack (>=2.1.0, <=2.13.1)

nitropack NPM version =2.1.0, =1.0.0, =1.5.0, =0.4.4, =0.6.1, =1.0.0, =1.0.0, =5.0.0-rc.212, =5.0.0-rc.212, =3.0.0, =4.0.0-alpha.1, =4.0.0-29145487.7beaa672, =7.40.3, =0.0.0-beta.0, =1.15.3, =1.31.24 and more Source cves: CVE-2026-44373 Source advisory: OSV:GHSA-5W89-W975-HF9Q...