CVE-2026-128077

Nuxt is an open-source web development framework for Vue.js. From 4.6.0 until 4.6.4, Nuxt parses a request path beginning with // as a URL host before rendering a page, while Nitro server/middleware and routeRules continue to evaluate the original path. An unauthenticated request such as //x/admi...

CVE-2026-128077

The Nuxt web development framework (versions 4.6.0 through 4.6.4 ) is vulnerable to an interpretation conflict where request paths beginning with // are incorrectly parsed as URL hosts. Because Nitro server/middleware and routeRules evaluate the original path while the renderer uses the parsed ho...

CVE-2026-128077 Nuxt: Incomplete fix for CVE-2026-119200: a leading `//` in the request path bypasses `server/middleware` path checks and server route rules on page routes

Nuxt is an open-source web development framework for Vue.js. From 4.6.0 until 4.6.4, Nuxt parses a request path beginning with // as a URL host before rendering a page, while Nitro server/middleware and routeRules continue to evaluate the original path. An unauthenticated request such as //x/admi...

CVE-2026-128071

The Nuxt web development framework (versions 3.0.0 to 4.6.4), along with @nuxt/nitro-server (3.20.0 to 4.6.4) and @nuxt/vite-server (4.6.0 to 4.6.4), contains a vulnerability where an encoded slash (%2F) in a request path bypasses routeRules . This occurs because the system leaves the slash encod...

Nuxt: Route Rules Are Matched Against The Raw Request Path, So A Percent-encoded Segment Can Bypass `appMiddleware` On D

Summary Nuxt compared "routeRules" keys against the raw request path, without decoding percent-encoding, while the router decodes parameters when it resolves a route. A request whose path is percent-encoded can therefore resolve to a page while failing to match the route rule meant to protect it,...

GHSA-VJH5-4X84-XRQP Nuxt: Server-side route rules (`redirect`, `headers`, `proxy`, `ssr`) are skipped for case-variant paths when routing is case-insensitive

Impact With the default router.options.sensitive: false, Nuxt's page router resolves routes case-insensitively, so /Admin renders the same page as /admin. On the server, however, route rules were resolved with Nitro's route-rule matcher, which matches keys case-sensitively. A request whose path...

Nuxt: Server-side route rules (`redirect`, `headers`, `proxy`, `ssr`) are skipped for case-variant paths when routing is case-insensitive

Impact With the default router.options.sensitive: false, Nuxt's page router resolves routes case-insensitively, so /Admin renders the same page as /admin. On the server, however, route rules were resolved with Nitro's route-rule matcher, which matches keys case-sensitively. A request whose path...

Nuxt: Route rules are matched against the raw request path, so a percent-encoded segment can bypass `appMiddleware` on dynamic and catch-all routes

Summary Nuxt compared routeRules keys against the raw request path, without decoding percent-encoding, while the router decodes parameters when it resolves a route. A request whose path is percent-encoded can therefore resolve to a page while failing to match the route rule meant to protect it, s...

GHSA-6GQ8-JGMH-3FFP Nuxt: Route rules are matched against the raw request path, so a percent-encoded segment can bypass `appMiddleware` on dynamic and catch-all routes

Summary Nuxt compared routeRules keys against the raw request path, without decoding percent-encoding, while the router decodes parameters when it resolves a route. A request whose path is percent-encoded can therefore resolve to a page while failing to match the route rule meant to protect it, s...

CVE-2026-71315

Nuxt is an open-source web development framework for Vue.js. From 3.21.7 until 3.21.10 and 4.5.1, mixed-case routeRules keys can fail to match case-folded lookups when router.options.sensitive is false and drop appMiddleware authorization gates. This is caused by an incomplete fix for...

CVE-2026-71315

Nuxt is an open-source web development framework for Vue.js. From 3.21.7 until 3.21.10 and 4.5.1, mixed-case routeRules keys can fail to match case-folded lookups when router.options.sensitive is false and drop appMiddleware authorization gates. This is caused by an incomplete fix for...

PT-2026-68335

Name of the Vulnerable Software and Affected Versions Nuxt versions 3.21.7 through 3.21.9 Nuxt versions 4.5.0 and earlier Description When router.options.sensitive is set to false, mixed-case routeRules keys may fail to match case-folded lookups. This occurs because the lookup path is converted t...

PT-2026-68336

Name of the Vulnerable Software and Affected Versions Nuxt versions 4.4.0 through 4.5.0 Description When a page is configured with routeRules using cache, swr, or isr, the framework enables runtime payload extraction via the endpoint // payload.json. In affected versions, the renderer stores the...

CVE-2026-71315: Improper Handling of Case Sensitivity

Nuxt is an open-source web development framework for Vue.js. From 3.21.7 until 3.21.10 and 4.5.1, mixed-case routeRules keys can fail to match case-folded lookups when router.options.sensitive is false and drop appMiddleware authorization gates. This is caused by an incomplete fix for...

CVE-2026-53721 Nuxt: Route-rule middleware bypass via case-sensitivity mismatch between vue-router and the routeRules matcher

Nuxt is an open-source web development framework for Vue.js. From versions 3.11.0 to before 3.21.7 and 4.0.0 to before 4.4.7, there is a route-rule middleware bypass via case-sensitivity mismatch between vue-router and the routeRules matcher. This issue has been patched in versions 3.21.7 and 4.4...

Nitro has an Open Redirect via Protocol-Relative URL Bypass in Wildcard Route Rules

A redirect route rule like: ts routeRules: "/legacy/": redirect: "/" is intended to rewrite paths within the same host. Before the patch, an attacker could turn the rewrite into a cross-host redirect by sliding an extra slash in after the rule prefix. Example exploit: GET /legacy//evil.com Nitro...

NPM: Nitro has a proxy scope bypass via percent-encoded path traversal in `routeRules`

NPM: Nitro has a proxy scope bypass via percent-encoded path traversal in routeRules vulnerability discovered by ? in WordPress Npm nitro versions 3.0.260429-beta...