Read the docs
TI-2026-78923 Aliases CVE-2026-114132GHSA-vjh5-4x84-xrqp

Nuxt server route rules skipped for case-variant paths

Priority LOW 28CWE-178Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Security bypass
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-863.

Summary

Nuxt from 4.0.0 before 4.6.2 and @nuxt/nitro-server from 4.2.0 before 4.6.2 resolve pages case-insensitively but match server route rules case-sensitively. A request whose path differs only by letter case can skip server route rules such as redirect, headers, proxy and ssr: false (CWE-178). An unauthenticated remote attacker can send such a request. Access checks in middleware and page data fetching are not affected.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Nuxt is an open-source web development framework for Vue.js. Prior to 4.6.2, Nuxt resolves pages case-insensitively by default while Nitro matches server-side route-rule keys case-sensitively, allowing a request whose path differs only by letter case to render without the server rule intended for that page. The mismatch can skip redirect, headers, proxy, ssr: false, and noScripts, and can cause getRouteRules(event) and matchRouteRules to return no rule for the case variant. Applications that set router.options.sensitive: true in nuxt.config are not affected; setting sensitive only in app/router.options.ts does not establish this exclusion because the server follows the nuxt.config value. Access checks implemented in server middleware, page route middleware, or page data fetching remain independent of this matcher. This issue is fixed in version 4.6.2.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00424 36th percentileScored 2026-11-07
Fix Fixed nuxt (nuxt): 4.6.2nuxt (npm): 4.6.2+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
nuxtnuxtbefore 4.6.24.6.2Patch availableCNA
—nuxt (npm)4.0.0 to before 4.6.24.6.2Patch availableGHSA-vjh5-4x84-xrqp
—nuxt (npm)3.0.0 and later—No fix listedGHSA-vjh5-4x84-xrqp
—@nuxt/nitro-server (npm)4.2.0 to before 4.6.24.6.2Patch availableGHSA-vjh5-4x84-xrqp
—@nuxt/nitro-server (npm)3.20.0 and later—No fix listedGHSA-vjh5-4x84-xrqp
  • nuxt Vendornuxt Affected before 4.6.2 Fixed in 4.6.2 Patch available CNA
  • nuxt (npm) Vendor— Affected 4.0.0 to before 4.6.2 Fixed in 4.6.2 Patch available GHSA-vjh5-4x84-xrqp
  • nuxt (npm) Vendor— Affected 3.0.0 and later Fixed in — No fix listed GHSA-vjh5-4x84-xrqp
  • @nuxt/nitro-server (npm) Vendor— Affected 4.2.0 to before 4.6.2 Fixed in 4.6.2 Patch available GHSA-vjh5-4x84-xrqp
  • @nuxt/nitro-server (npm) Vendor— Affected 3.20.0 and later Fixed in — No fix listed GHSA-vjh5-4x84-xrqp

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:nuxt:nuxt:*:*:*:*:*:*:*:*——nuxt
  • cpe:2.3:a:nuxt:nuxt:*:*:*:*:*:*:*:* Versions — — ·nuxt

Remediation

Upgrade nuxt to 4.6.2 if it is from 4.0.0 before 4.6.2, and upgrade @nuxt/nitro-server to 4.6.2 if it is from 4.2.0 before 4.6.2. The sources list no fixed version for nuxt from 3.0.0 or @nuxt/nitro-server from 3.20.0.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA nuxt (nuxt) Fixed in 4.6.2
  • Fix · GHSA-vjh5-4x84-xrqp nuxt (npm) Fixed in 4.6.2 Advisory →
  • Fix · GHSA-vjh5-4x84-xrqp @nuxt/nitro-server (npm) Fixed in 4.6.2 Advisory →

Timeline

  1. 2026-10-21 Threatist record created from CVE-2026-114132
  2. 2026-10-22 Alias added: GHSA-vjh5-4x84-xrqp
  3. 2026-10-22 Fix available: npm/@nuxt/[email protected], npm/[email protected] · GHSA-vjh5-4x84-xrqp
  4. 2026-10-22 CVSS score added · GHSA-vjh5-4x84-xrqp
  5. 2026-10-22 Weakness changed · GHSA-vjh5-4x84-xrqp
  6. 2026-10-22 5 new references · GHSA-vjh5-4x84-xrqp
  7. 2026-10-23 Priority changed: MEDIUM → LOW
  8. 2026-10-23 CISA SSVC decision points changed

References

Advisory 1

Other 4

  • TI-2023-03020 Code Injection in nuxt/nuxt CVSS 3.1CRITICAL 9.8
  • TI-2024-28339 Server-Side Request Forgery (SSRF) in nuxt-icon CVSS 3.1HIGH 8.6
  • TI-2024-22685 Remote code execution via the browser when running the test locally in nuxt CVSS 3.1HIGH 8.8
  • TI-2026-26689 Nuxt OG Image vulnerable to DoS via image generation CVSS 4.0MEDIUM 6.9
  • TI-2022-04037 Cross-site Scripting (XSS) - DOM in nuxt/framework CVSS 3.1MEDIUM 6.1
  • TI-2022-04036 Cross-site Scripting (XSS) - Reflected in nuxt/framework CVSS 3.1MEDIUM 6.1
See all 44 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences