Nuxt: Route Rules Are Matched Against The Raw Request Path, So A Percent-encoded Segment Can Bypass `appMiddleware` On D

Summary Nuxt compared "routeRules" keys against the raw request path, without decoding percent-encoding, while the router decodes parameters when it resolves a route. A request whose path is percent-encoded can therefore resolve to a page while failing to match the route rule meant to protect it,...

Nuxt: Route rules are matched against the raw request path, so a percent-encoded segment can bypass `appMiddleware` on dynamic and catch-all routes

Summary Nuxt compared routeRules keys against the raw request path, without decoding percent-encoding, while the router decodes parameters when it resolves a route. A request whose path is percent-encoded can therefore resolve to a page while failing to match the route rule meant to protect it, s...

EUVD-2026-107414

Nuxt: Route rules are matched against the raw request path, so a percent-encoded segment can bypass appMiddleware on dynamic and catch-all routes...

GHSA-6GQ8-JGMH-3FFP Nuxt: Route rules are matched against the raw request path, so a percent-encoded segment can bypass `appMiddleware` on dynamic and catch-all routes

Summary Nuxt compared routeRules keys against the raw request path, without decoding percent-encoding, while the router decodes parameters when it resolves a route. A request whose path is percent-encoded can therefore resolve to a page while failing to match the route rule meant to protect it, s...

npm: Nuxt: Route rules are matched against the raw request path, so a percent-encoded segment can bypass `appMiddleware` on dynamic and catch-all routes

npm: Nuxt: Route rules are matched against the raw request path, so a percent-encoded segment can bypass appMiddleware on dynamic and catch-all routes vulnerability discovered by ? in WordPress npm nuxt versions = 3.11.0, 3.21.4...

CVE-2026-114131

Nuxt is an open-source web development framework for Vue.js. From 3.11.0 until 3.21.4 and 4.4.4, Nuxt compares route-rule keys with the raw request path while route resolution decodes dynamic and catch-all parameters, allowing a percent-encoded segment to resolve to a protected page without...

CVE-2026-114131 Nuxt: Route rules are matched against the raw request path, so a percent-encoded segment can bypass `appMiddleware` on dynamic and catch-all routes

Nuxt is an open-source web development framework for Vue.js. From 3.11.0 until 3.21.4 and 4.4.4, Nuxt compares route-rule keys with the raw request path while route resolution decodes dynamic and catch-all parameters, allowing a percent-encoded segment to resolve to a protected page without...

CVE-2026-114131 Nuxt: Route rules are matched against the raw request path, so a percent-encoded segment can bypass `appMiddleware` on dynamic and catch-all routes

Nuxt is an open-source web development framework for Vue.js. From 3.11.0 until 3.21.4 and 4.4.4, Nuxt compares route-rule keys with the raw request path while route resolution decodes dynamic and catch-all parameters, allowing a percent-encoded segment to resolve to a protected page without...

CVE-2026-114131

The Nuxt web development framework (versions 3.11.0 up to 3.21.4 and 4.4.4) is vulnerable to a security bypass due to an interpretation conflict . The framework compares route-rule keys against the raw request path while decoding dynamic and catch-all parameters during route resolution. An attack...

CVE-2026-114131

Nuxt is an open-source web development framework for Vue.js. From 3.11.0 until 3.21.4 and 4.4.4, Nuxt compares route-rule keys with the raw request path while route resolution decodes dynamic and catch-all parameters, allowing a percent-encoded segment to resolve to a protected page without...

PT-2026-120734

Name of the Vulnerable Software and Affected Versions Nuxt versions 3.11.0 through 3.21.3 Nuxt versions 4.0.0 through 4.4.3 Description Nuxt compares route-rule keys with the raw request path, whereas route resolution decodes dynamic and catch-all parameters. This discrepancy allows a...

Nuxt processing logic error vulnerability

A security vulnerability exists in Nuxt versions prior to 3.21.4, as well as versions 3.11.0 and later, and prior to 4.4.4, as well as version 4.0.0 and later. This vulnerability stems from improper handling of percent encoding when comparing route rule keys against the original request path. As ...

CVE-2026-71315

Nuxt is an open-source web development framework for Vue.js. From 3.21.7 until 3.21.10 and 4.5.1, mixed-case routeRules keys can fail to match case-folded lookups when router.options.sensitive is false and drop appMiddleware authorization gates. This is caused by an incomplete fix for...

CVE-2026-71315 Nuxt route rules silently dropped for mixed-case paths, bypassing appMiddleware auth gates (incomplete fix for CVE-2026-53721)

Nuxt is an open-source web development framework for Vue.js. From 3.21.7 until 3.21.10 and 4.5.1, mixed-case routeRules keys can fail to match case-folded lookups when router.options.sensitive is false and drop appMiddleware authorization gates. This is caused by an incomplete fix for...

PT-2026-68335

Name of the Vulnerable Software and Affected Versions Nuxt versions 3.21.7 through 3.21.9 Nuxt versions 4.5.0 and earlier Description When router.options.sensitive is set to false, mixed-case routeRules keys may fail to match case-folded lookups. This occurs because the lookup path is converted t...