Nuxt: Dot segments in the request path bypass `server/middleware` path checks and server route rules on page routes

At a glance

nuxt: Yellow, plan it in. Nuxt is an open-source web development framework for Vue.js. Prior to 4.6.2, Nuxt resolves pages case-insensitively by default while Nitro matches server-side route-rule keys case-sensitively, allowing a request whose path differs only by letter case to render without the server rule intended for that page. The mismat…

The flaws

• CVE-2026-119200: Nuxt: Dot segments in the request path bypass `server/middleware` path checks and server route rules on page routes (CVSS 6.5)
• CVE-2026-114132: Nuxt: Server-side route rules (`redirect`, `headers`, `proxy`, `ssr`) are skipped for case-variant paths when routing is case-insensitive (CVSS 6.3 · EPSS 0%)
• CVE-2026-114131: Nuxt: Route rules are matched against the raw request path, so a percent-encoded segment can bypass `appMiddleware` on dynamic and catch-all routes (CVSS 6.5 · EPSS 0%)

The fix

Upgrade nuxt: 4.6.3 · 4.6.2 · 4.4.4 · 3.21.4 or later on your release line

Who is exposed: nuxt (npm) >= 4.0.0, < 4.6.2; nuxt (npm) >= 3.0.0, < 4.0.0; @nuxt/nitro-server (npm) >= 4.2.0, < 4.6.2; @nuxt/nitro-server (npm) >= 3.20.0, < 4.0.0

Where it stands

• No known exploitation

Connects to

• Same weakness: CWE-41 (CWE-41). 6 other warnings in 30 days