Nitro is a next-generation server framework that allows developers to define redirect rules with wildcard rewrite patterns. Prior to version 3.0.260429-beta, a protocol-relative URL bypass could be triggered by inserting an additional slash after the prefix of a wildcard rule, which steers the rewrite logic to redirect to an arbitrary host. This flaw enables attackers to craft URLs that, when processed by Nitro, redirect end users to hostile domains, thereby facilitating phishing or man‑in‑the‑middle attacks. The weakness is a classic Open Redirect vulnerability identified as CWE‑601.

Vendors nitrojs with the nitro and nitropack products are affected. Any instance running Nitro before the 3.0.260429-beta release is vulnerable; the vulnerability remains present in earlier major releases such as 2.x.

The flaw carries a CVSS score of 5.3, indicating moderate severity. The EPSS score is currently unavailable, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires manipulation of server‑side redirect rules, implying the attacker likely needs administrator or developer access to modify Nitro’s configuration or to influence the routing logic. If such access is present, the attacker can redirect any user visiting a crafted URL to a malicious host.