Read the docs
TI-2026-83675 Aliases CVE-2026-120309GHSA-r8g5-gwcc-5r5r

Nuxt Route Parameter Confusion via getRouterParam and getRouterParams

Priority LOW 27CWE-436Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Nuxt from 4.6.0 before 4.6.2 has a route parameter confusion flaw in getRouterParam and getRouterParams, tracked as CWE-436 (interpretation conflict). Sending paths with an encoded question mark (%3F) makes the helpers return a parameter value different from the one h3 matched. An unauthenticated remote attacker can craft requests where authorization checks use the helper value while resource selection uses event.context.params, gaining access to unauthorized resources. The attack has high complexity and requires a specific application setup.

Written with Claude Haiku 5.5 from the sources below · 2026-11-02

Description from the CNA

Nuxt from 4.6.0 before 4.6.2 contains a route parameter confusion vulnerability in getRouterParam and getRouterParams that lets attackers return a parameter value different from the one h3 matched by sending paths containing an encoded question mark (%3F). Attackers can craft requests where authorization checks use the Nuxt helper value while resource selection uses event.context.params, allowing access to unauthorized resources.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00229 13th percentileScored 2026-11-07
Fix Fixed nuxt (nuxt): 4.6.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
nuxtnuxt4.6.0 to before 4.6.24.6.2Patch availableCNA
nuxtnuxt4.6.0 to before 4.6.24.6.2Patch availableCNA
  • nuxt Vendornuxt Affected 4.6.0 to before 4.6.2 Fixed in 4.6.2 Patch available CNA
  • nuxt Vendornuxt Affected 4.6.0 to before 4.6.2 Fixed in 4.6.2 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:nuxt:nuxt:*:*:*:*:*:*:*:*——nuxt
  • cpe:2.3:a:nuxt:nuxt:*:*:*:*:*:*:*:* Versions — — ·nuxt

Remediation

Upgrade Nuxt to 4.6.2 or later, the fixed version.

Written with Claude Haiku 5.5 from the sources below · 2026-11-02

  • Fix · CNA nuxt (nuxt) Fixed in 4.6.2
  • Fix · CNA nuxt (nuxt) Fixed in 4.6.2

Timeline

  1. 2026-11-02 Threatist record created from CVE-2026-120309
  2. 2026-11-02 Alias added: GHSA-r8g5-gwcc-5r5r
  3. 2026-11-02 CISA SSVC decision points changed
  4. 2026-11-02 Priority changed: MEDIUM → LOW

References

Advisory 1

  • TI-2023-03020 Code Injection in nuxt/nuxt CVSS 3.1CRITICAL 9.8
  • TI-2024-28339 Server-Side Request Forgery (SSRF) in nuxt-icon CVSS 3.1HIGH 8.6
  • TI-2024-22685 Remote code execution via the browser when running the test locally in nuxt CVSS 3.1HIGH 8.8
  • TI-2026-26689 Nuxt OG Image vulnerable to DoS via image generation CVSS 4.0MEDIUM 6.9
  • TI-2022-04037 Cross-site Scripting (XSS) - DOM in nuxt/framework CVSS 3.1MEDIUM 6.1
  • TI-2022-04036 Cross-site Scripting (XSS) - Reflected in nuxt/framework CVSS 3.1MEDIUM 6.1
See all 44 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences