CVE-2026-114132 in Nuxt
Summary
by MITRE • 10/21/2026
Nuxt is an open-source web development framework for Vue.js. Prior to 4.6.2, Nuxt resolves pages case-insensitively by default while Nitro matches server-side route-rule keys case-sensitively, allowing a request whose path differs only by letter case to render without the server rule intended for that page. The mismatch can skip redirect, headers, proxy, ssr: false, and noScripts, and can cause getRouteRules(event) and matchRouteRules to return no rule for the case variant. Applications that set router.options.sensitive: true in nuxt.config are not affected; setting sensitive only in app/router.options.ts does not establish this exclusion because the server follows the nuxt.config value. Access checks implemented in server middleware, page route middleware, or page data fetching remain independent of this matcher. This issue is fixed in version 4.6.2.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
Nuxt serves as a prominent open-source framework for building Vue.js applications, providing developers with tools to create dynamic web interfaces and handle server-side rendering efficiently. A critical architectural inconsistency was identified within the routing mechanisms of Nuxt versions prior to 4.6.2, specifically concerning how page paths are resolved on the client side versus how route rules are matched on the server side via Nitro. This discrepancy arises from a fundamental difference in case sensitivity handling between these two components. By default, Nuxt resolves pages using case-insensitive logic, meaning it treats URLs with different letter casing as equivalent to their canonical counterparts. In contrast, the underlying Nitro server engine matches route-rule keys defined by developers on a strictly case-sensitive basis. This divergence creates a scenario where requests targeting paths that differ only in character case can bypass intended server-side configurations entirely.
The operational impact of this vulnerability is significant for applications relying on specific routing behaviors such as redirects, custom headers, proxying rules, or the disabling of server-side rendering and script injection through route rules. When an attacker crafts a request with a path variant that differs only in casing from the configured rule key, the Nitro engine fails to recognize it as matching any defined rule due to its case-sensitive nature. Consequently, the application may render content without applying necessary security headers or redirects, potentially exposing sensitive data or allowing unauthorized access patterns. Furthermore, internal functions like getRouteRules and matchRouteRules return no applicable rules for these case-variant requests, leaving them unhandled by the expected server-side logic. This behavior effectively creates a blind spot in the application's routing defense layer, where security controls tied to specific route configurations are silently ignored.
Mitigation strategies must address both configuration consistency and framework updates. The most direct solution is upgrading Nuxt to version 4.6.2 or later, which resolves this mismatch by aligning case sensitivity handling across client and server components. For environments unable to upgrade immediately, developers can enforce strict routing behavior by setting router.options.sensitive: true within the nuxt.config file. It is crucial to note that configuring sensitive mode exclusively in app/router.options.ts does not prevent this vulnerability because the Nitro server relies on the configuration value found in nuxt.config. Additionally, while access checks implemented via server middleware, page route middleware, or data fetching logic remain independent of this specific matcher and thus are not affected by the case-sensitivity flaw, relying solely on these layers for security is insufficient given the broader impact on routing rules such as redirects and header injection.
From a cybersecurity classification perspective, this vulnerability aligns with CWE-16 regarding configuration issues where inconsistent settings lead to unexpected behavior. It also relates to ATT&CK techniques involving evasion or misconfiguration exploitation, specifically how attackers might manipulate URL casing to bypass security controls like HTTP headers or access restrictions. The flaw highlights the importance of consistent validation logic across all layers of a web application stack. Developers must ensure that client-side routing expectations align with server-side enforcement mechanisms to prevent such discrepancies from being exploited for unauthorized access or information disclosure. Regular auditing of route configurations and adherence to framework best practices are essential to maintaining robust security postures in modern Vue.js-based applications.