CVE-2026-114131

Awaiting Analysis Awaiting Analysis - Queue

Path Traversal in Nuxt.js Framework

Publication date: 2026-10-21

Last updated on: 2026-10-30

Assigner: GitHub, Inc.

Description

Nuxt is an open-source web development framework for Vue.js. From 3.11.0 until 3.21.4 and 4.4.4, Nuxt compares route-rule keys with the raw request path while route resolution decodes dynamic and catch-all parameters, allowing a percent-encoded segment to resolve to a protected page without matching the routeRules entry intended for that path. As a result, appMiddleware can be skipped during server rendering and an unauthenticated requester can receive the gated page and its SSR data. The same mismatch affects app-manifest rules including redirect, appLayout, ssr, prerender, and payload flags derived from cache, isr, and swr. This vulnerability is fixed in 4.4.4 and 3.21.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-30

Generated

2026-11-10

AI Q&A

2026-10-22

EPSS Evaluated

2026-11-09

NVD

CVE-2026-114131

EUVD

EUVD-2026-107414

Affected Vendors & Products

Vendor	Product	Version / Range
nuxt	nuxt	>= 4.0.0, < 4.4.4
nuxt	nuxt	>= 3.11.0, < 3.21.4

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-436	Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state.
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

This vulnerability in Nuxt affects route rule matching by comparing raw request paths with percent-encoded segments against decoded route rules. This mismatch allows attackers to bypass authentication middleware on protected pages by using encoded paths like /users/%61dmin, which resolves to /users/admin but skips route rule enforcement. The issue exists in Nuxt versions between 3.11.0-3.21.3 and 4.0.0-4.4.3.

Detection Guidance

Check Nuxt version with npm list nuxt or grep version in package.json. If using versions between 3.11.0-3.21.3 or 4.0.0-4.4.3, the system is vulnerable. Test by sending a request with a percent-encoded path like /users/%61dmin and verify if it bypasses authentication middleware.

Impact Analysis

An unauthenticated attacker could access protected pages and receive server-side rendered data by using percent-encoded paths. This bypasses appMiddleware and route rules designed to restrict access. The impact includes unauthorized data exposure and potential privilege escalation if sensitive pages are involved.

Mitigation Strategies

Upgrade Nuxt to version 4.4.4 or later, or 3.21.4 or later. If upgrading is not possible, add middleware directly to protected pages as a workaround. Monitor logs for unusual requests with percent-encoded paths.

Hi! I’m here to help you understand CVE-2026-114131. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...