CVE-2026-114132

Awaiting Analysis Awaiting Analysis - Queue

Nuxt Framework Case-Sensitive Route Rule Bypass

Publication date: 2026-10-21

Last updated on: 2026-10-23

Assigner: GitHub, Inc.

Description

Nuxt is an open-source web development framework for Vue.js. Prior to 4.6.2, Nuxt resolves pages case-insensitively by default while Nitro matches server-side route-rule keys case-sensitively, allowing a request whose path differs only by letter case to render without the server rule intended for that page. The mismatch can skip redirect, headers, proxy, ssr: false, and noScripts, and can cause getRouteRules(event) and matchRouteRules to return no rule for the case variant. Applications that set router.options.sensitive: true in nuxt.config are not affected; setting sensitive only in app/router.options.ts does not establish this exclusion because the server follows the nuxt.config value. Access checks implemented in server middleware, page route middleware, or page data fetching remain independent of this matcher. This issue is fixed in version 4.6.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-23

Generated

2026-11-10

AI Q&A

2026-10-22

EPSS Evaluated

2026-11-09

NVD

CVE-2026-114132

EUVD

EUVD-2026-107416

Affected Vendors & Products

Vendor	Product	Version / Range
nuxt	nuxt	< 4.6.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-178	The product does not properly account for differences in case sensitivity when accessing or determining the properties of a resource, leading to inconsistent results.
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

This vulnerability affects Nuxt, a Vue.js framework, where server-side route rules are skipped if the request path differs from the rule key only in letter case. The server resolves routes case-sensitively while the client resolves them case-insensitively, causing mismatches. For example, a rule for /admin/** would not apply to /ADMIN/secret.

Detection Guidance

To detect this vulnerability, check your Nuxt version with 'npm list nuxt' or 'yarn list nuxt'. If it is below 4.6.2, the system is vulnerable. Inspect server routes for case mismatches by testing paths like /Admin/secret against /admin/secret to see if route rules apply inconsistently.

Impact Analysis

This vulnerability can bypass intended protections like redirects, security headers, proxy settings, and SSR rendering. Attackers could exploit case variations in URLs to evade these safeguards, potentially accessing unintended content or bypassing security measures.

Mitigation Strategies

Upgrade Nuxt to version 4.6.2 or later. Alternatively, set 'router.options.sensitive: true' in nuxt.config.js to enforce case-sensitive routing. Ensure all server-side route rules are tested for case sensitivity after changes.

Hi! I’m here to help you understand CVE-2026-114132. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...