Nixpkgs security tracker

Untriaged

Permalink CVE-2026-44373

5.3 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): Low (L)
Integrity (I): None (N)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): Low (L)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): None (N)

created 1 day, 20 hours ago Activity log

Created suggestion 1 day, 20 hours ago

Nitro: Proxy scope bypass via percent-encoded path traversal in `routeRules`

Nitro is a next generation server toolkit. Prior to 3.0.260429-beta, an attacker could bypass a proxy route rule by sending percent-encoded path traversal (..%2f) in the URL, causing Nitro to forward a request that the upstream resolved outside the configured scope. This vulnerability is fixed in 3.0.260429-beta.

References

https://github.com/nitrojs/nitro/security/advisories/GHSA-5w89-w975-hf9q x_refsource_CONFIRM
https://github.com/nitrojs/nitro/pull/4222 x_refsource_MISC
https://github.com/nitrojs/nitro/pull/4223 x_refsource_MISC
https://github.com/nitrojs/nitro/releases/tag/v2.13.4 x_refsource_MISC
https://github.com/nitrojs/nitro/releases/tag/v3.0.260429-beta x_refsource_MISC

Affected products

nitro

==< 3.0.260429-beta

nitropack

==< 2.13.4

Matching in nixpkgs

pkgs.nitrocli

Command line tool for interacting with Nitrokey devices

nixos-unstable 0.4.1
- nixpkgs-unstable 0.4.1
- nixos-unstable-small 0.4.1
nixos-25.11 0.4.1
- nixos-25.11-small 0.4.1
- nixpkgs-25.11-darwin 0.4.1

pkgs.nitrogen

Wallpaper browser and setter for X11

nixos-unstable 1.6.1
- nixpkgs-unstable 1.6.1
- nixos-unstable-small 1.6.1
nixos-25.11 1.6.1
- nixos-25.11-small 1.6.1
- nixpkgs-25.11-darwin 1.6.1

pkgs.pynitrokey

Python client for Nitrokey devices

nixos-unstable 0.11.4
- nixpkgs-unstable 0.11.4
- nixos-unstable-small 0.11.4
nixos-25.11 0.11.2
- nixos-25.11-small 0.11.2
- nixpkgs-25.11-darwin 0.11.2

pkgs.libnitrokey

Communicate with Nitrokey devices in a clean and easy manner

nixos-unstable 3.8
- nixpkgs-unstable 3.8
- nixos-unstable-small 3.8
nixos-25.11 3.8
- nixos-25.11-small 3.8
- nixpkgs-25.11-darwin 3.8

pkgs.nitrokey-app

Provides extra functionality for the Nitrokey Pro and Storage

nixos-unstable 1.4.2
- nixpkgs-unstable 1.4.2
- nixos-unstable-small 1.4.2
nixos-25.11 1.4.2
- nixos-25.11-small 1.4.2
- nixpkgs-25.11-darwin 1.4.2

pkgs.nitrokey-app2

This application allows to manage Nitrokey 3 devices

nixos-unstable app2-2.5.2
- nixpkgs-unstable app2-2.5.2
- nixos-unstable-small app2-2.5.2
nixos-25.11 app2-2.4.3
- nixos-25.11-small app2-2.4.3
- nixpkgs-25.11-darwin app2-2.4.3