Vulnerability · Published Oct 21, 2026 · Assigned by GitHub_M

CVE-2026-114132Nuxt: Server-side route rules (`redirect`, `headers`, `proxy`, `ssr`) are skipped for case-variant paths when routing is case-insensitive

Medium 6.3

In plain English

A medium-severity incorrect authorization in nuxt from nuxt. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)6.3Medium

Exploit odds (30 days)0.4%top 63.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Nuxt is an open-source web development framework for Vue.js. Prior to 4.6.2, Nuxt resolves pages case-insensitively by default while Nitro matches server-side route-rule keys case-sensitively, allowing a request whose path differs only by letter case to render without the server rule intended for that page. The mismatch can skip redirect, headers, proxy, ssr: false, and noScripts, and can cause getRouteRules(event) and matchRouteRules to return no rule for the case variant. Applications that set router.options.sensitive: true in nuxt.config are not affected; setting sensitive only in app/router.options.ts does not establish this exclusion because the server follows the nuxt.config value. Access checks implemented in server middleware, page route middleware, or page data fetching remain independent of this matcher. This issue is fixed in version 4.6.2.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	@nuxt/nitro-server	4.6.2	GHSA-vjh5-4x84-xrqp
npm	@nuxt/nitro-server	no fix listed	GHSA-vjh5-4x84-xrqp
npm	nuxt	4.6.2	GHSA-vjh5-4x84-xrqp
npm	nuxt	no fix listed	GHSA-vjh5-4x84-xrqp

Affected products (as reported)

Vendor	Product	Versions
nuxt	nuxt	< 4.6.2

Weakness: CWE-178, CWE-863 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

References

https://github.com/nuxt/nuxt/security/advisories/GHSA-vjh5-4x84-xrqp x_refsource_CONFIRM
https://github.com/nuxt/nuxt/commit/f6cfee52cf9576ddc4f4ee83b486969328b358f8 x_refsource_MISC
https://github.com/nuxt/nuxt/releases/tag/v4.6.2 x_refsource_MISC