Vulnerability · Published Nov 2, 2026 · Assigned by VulnCheck

CVE-2026-120309Nuxt 4.6.0 before 4.6.2 Route Param Confusion via getRouterParam

Low 3.7

In plain English

A low-severity security flaw in nuxt from nuxt. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities).

Severity (CVSS 3.1)3.7Low

Exploit odds (30 days)0.2%top 86.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Nuxt from 4.6.0 before 4.6.2 contains a route parameter confusion vulnerability in getRouterParam and getRouterParams that lets attackers return a parameter value different from the one h3 matched by sending paths containing an encoded question mark (%3F). Attackers can craft requests where authorization checks use the Nuxt helper value while resource selection uses event.context.params, allowing access to unauthorized resources.

Affected products (as reported)

Vendor	Product	Versions
nuxt	nuxt	4.6.0 – before 4.6.2
nuxt	nuxt	4.6.0 – before 4.6.2

Weakness: CWE-436 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

References

GitHub Security Advisory (GHSA-w7gw-66vg-99gq) vendor-advisory
VulnCheck Advisory: Nuxt 4.6.0 before 4.6.2 Route Param Confusion via getRouterParam third-party-advisory