CVE-2026-114131 in Nuxt
Summary
by MITRE • 10/22/2026
Nuxt is an open-source web development framework for Vue.js. From 3.11.0 until 3.21.4 and 4.4.4, Nuxt compares route-rule keys with the raw request path while route resolution decodes dynamic and catch-all parameters, allowing a percent-encoded segment to resolve to a protected page without matching the routeRules entry intended for that path. As a result, appMiddleware can be skipped during server rendering and an unauthenticated requester can receive the gated page and its SSR data. The same mismatch affects app-manifest rules including redirect, appLayout, ssr, prerender, and payload flags derived from cache, isr, and swr. This vulnerability is fixed in 4.4.4 and 3.21.4.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/22/2026
The Nuxt framework, a popular open-source development tool for building Vue.js applications, contains a critical routing logic flaw that undermines security controls and configuration integrity. The vulnerability exists within the server-side route resolution mechanism, specifically affecting versions from 3.11.0 up to 3.21.4 and version 4.4.4. This issue stems from an inconsistency in how Nuxt processes URL paths during different stages of request handling. When a client sends a request containing percent-encoded characters within the path segments, such as spaces or special symbols encoded as %XX sequences, the framework handles these inputs differently depending on whether it is evaluating route rules or resolving the actual page component to render.
The core technical flaw lies in the comparison logic used for applying routeRules. Nuxt compares the keys defined in the configuration against the raw, un-decoded request path provided by the HTTP client. However, during the subsequent phase of dynamic and catch-all parameter resolution, the framework decodes these percent-encoded segments to determine which Vue component or page should be served. This discrepancy creates a scenario where an attacker can craft a URL with encoded characters that bypasses specific route rules while still resolving to the intended protected resource. For instance, if a rule is configured to block access to /admin using a direct path match, sending a request for %2Fadmin allows the request to slip past the rule check because the raw string does not match, yet it decodes to /admin during resolution, granting access to the page.
The operational impact of this vulnerability is significant, particularly regarding authentication and authorization controls implemented via appMiddleware. Because the route rules are bypassed due to the encoding mismatch, middleware functions that enforce security checks can be skipped entirely during server-side rendering. This allows unauthenticated users or attackers with insufficient privileges to access gated pages and retrieve sensitive data rendered on the server side. The exposure of Server-Side Rendering (SSR) data means that confidential information intended for authenticated sessions may be exposed in the initial HTML payload, leading to potential data leakage and unauthorized access to protected application features.
Beyond authentication middleware, this inconsistency affects other critical configuration flags derived from route rules, including redirect behaviors, layout assignments, SSR toggles, prerendering settings, and payload generation options related to caching strategies like ISR (Incremental Static Regeneration) and SWR (Stale-While-Revalidate). An attacker could potentially manipulate these configurations by exploiting the encoding mismatch, leading to unintended redirects, incorrect page layouts being served, or bypassing cache controls that might expose stale or sensitive data. This broad impact highlights a systemic issue in how Nuxt normalizes paths for security policies versus functional routing logic.
From a classification perspective, this vulnerability aligns with CWE-20 Improper Input Validation and CWE-798 Use of Hard-coded Credentials if the bypass leads to unauthorized access without proper checks. In terms of attack vectors, it relates to ATT&CK technique T1564 Hidden Files and Directories or more broadly to path traversal concepts where encoding is used to evade security filters. The root cause is a failure in input normalization before applying security policies, allowing encoded payloads to bypass intended restrictions.
To mitigate this vulnerability, organizations must immediately upgrade Nuxt to version 3.21.4 or later for the Vue 2/3 legacy branches and version 4.4.4 or later for newer releases where these inconsistencies have been corrected by ensuring consistent decoding of path segments before rule evaluation. For applications that cannot be upgraded instantly, developers should implement additional server-side validation layers that normalize URL paths using standard decoding functions before applying any route-based security rules. It is also advisable to review middleware configurations to ensure they perform independent authentication checks rather than relying solely on Nuxt's internal routing guards for critical security boundaries. Regularly auditing dependency versions and keeping frameworks updated remains the most effective defense against such logic flaws in web application architectures.