https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 09 Oct 2026 02:33:58 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-318542 EUVD-2026-318542 https://cve.radiocsirt.org/vuln/euvd-2026-318542 https://cve.radiocsirt.org/vuln/fkie_cve-2026-44372 <p>Nitro is a next generation server toolkit. Prior to 3.0.260429-beta, an attacker could turn a redirect route rule using wildcards rewrite into a cross-host redirect by sliding an extra slash in after the rule prefix. This vulnerability is fixed in 3.0.260429-beta.</p> <p>Nitro is a next generation server toolkit. Prior to 3.0.260429-beta, an attacker could turn a redirect route rule using wildcards rewrite into a cross-host redirect by sliding an extra slash in after the rule prefix. This vulnerability is fixed in 3.0.260429-beta.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-44372 https://cve.radiocsirt.org/vuln/ghsa-9phm-9p8f-hw5m <p><strong>Affected:</strong> npm: nitro, npm: nitropack</p> <p>A redirect route rule like:</p> <p>```ts routeRules: { &#34;/legacy/**&#34;: { redirect: &#34;/**&#34; } } ```</p> <p>is intended to rewrite paths within the same host. Before the patch, an attacker could turn the rewrite into a cross-host redirect by sliding an extra slash in after the rule prefix. Example exploit:</p> <p>``` GET /legacy//evil.com ```</p> <p>Nitro stripped `/legacy` from the matched pathname and joined the remainder against the rule&#39;s target. The remainder was `//evil.com`, which the join preserved verbatim, so Nitro responded with `Location: //evil.com`. Browsers resolve `//evil.com` as a protocol-relative URL against the current scheme, sending the user to `https://evil.com`.</p> <p>### Are you affected?</p> <p>Users may be affected if **all** of the following are true:</p> <p>1. Their project uses Nitro&#39;s `routeRules` with a `redirect` entry. 2. The target uses a `/**` wildcard suffix to forward sub-paths (e.g. `redirect: &#34;/**&#34;`, `redirect: &#34;/new/**&#34;`, `proxy: { to: &#34;http://upstream/**&#34; }`). 3. The `redirect` rule is _not_ handled natively at the CDN layer. The `vercel`, `netlify`, `cloudflare-pages`, and `edgeone` presets translate `routeRules.redirect` into platform config (`vercel.json`, `_redirects`, EdgeOne v3 config) and serve the redirect at the edge — those deployments bypass the Nitro runtime entirely and are not affected. Every other preset executes the redirect through the Nitro runtime and can be vulnerable.</p> <p>## Impact</p> <p>Open redirect from any host serving Nitro with a wildcard `redirect` rule. Th…</p> <p><strong>Affected:</strong> npm: nitro, npm: nitropack</p> <p>A redirect route rule like:</p> <p>```ts routeRules: { &#34;/legacy/**&#34;: { redirect: &#34;/**&#34; } } ```</p> <p>is intended to rewrite paths within the same host. Before the patch, an attacker could turn the rewrite into a cross-host redirect by sliding an extra slash in after the rule prefix. Example exploit:</p> <p>``` GET /legacy//evil.com ```</p> <p>Nitro stripped `/legacy` from the matched pathname and joined the remainder against the rule&#39;s target. The remainder was `//evil.com`, which the join preserved verbatim, so Nitro responded with `Location: //evil.com`. Browsers resolve `//evil.com` as a protocol-relative URL against the current scheme, sending the user to `https://evil.com`.</p> <p>### Are you affected?</p> <p>Users may be affected if **all** of the following are true:</p> <p>1. Their project uses Nitro&#39;s `routeRules` with a `redirect` entry. 2. The target uses a `/**` wildcard suffix to forward sub-paths (e.g. `redirect: &#34;/**&#34;`, `redirect: &#34;/new/**&#34;`, `proxy: { to: &#34;http://upstream/**&#34; }`). 3. The `redirect` rule is _not_ handled natively at the CDN layer. The `vercel`, `netlify`, `cloudflare-pages`, and `edgeone` presets translate `routeRules.redirect` into platform config (`vercel.json`, `_redirects`, EdgeOne v3 config) and serve the redirect at the edge — those deployments bypass the Nitro runtime entirely and are not affected. Every other preset executes the redirect through the Nitro runtime and can be vulnerable.</p> <p>## Impact</p> <p>Open redirect from any host serving Nitro with a wildcard `redirect` rule. Th…</p> https://cve.radiocsirt.org/vuln/ghsa-9phm-9p8f-hw5m