Path Traversal Vulnerability in Nitro Server Toolkit by Nitro

CVE-2026-44373

What is CVE-2026-44373?

The Nitro Server Toolkit, prior to version 3.0.260429-beta, is susceptible to a path traversal vulnerability that allows an attacker to bypass proxy route rules. By crafting a URL with percent-encoded path traversal sequences (..%2f), the attacker can manipulate the toolkit into forwarding requests to upstream targets outside its intended configuration scope. This flaw poses significant risks, enabling unauthorized access and manipulation of server responses.

References