Nuxt Route Parameter Confusion via Encoded Question Mark

Executive Summary

This vulnerability is a route parameter confusion issue in Nuxt versions 4.6.0 to 4.6.1. It occurs in the getRouterParam and getRouterParams functions, where attackers can manipulate parameter values by sending paths with an encoded question mark (%3F). This causes a mismatch between the parameter value used in authorization checks and the one matched by h3, potentially allowing unauthorized resource access.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect your Nuxt.js application for versions 4.6.0 to 4.6.1. Check if your application uses getRouterParam or getRouterParams functions and relies on multiple sources for route parameters. Test paths containing encoded question marks (%3F) to see if parameter mismatches occur between authorization checks and resource selection.

Useful 0 Not Useful 0

Impact Analysis

If your application uses Nuxt 4.6.0 to 4.6.1 and relies on different sources for authorization checks and resource selection, attackers could exploit this to bypass authorization. For example, a request might pass an authorization check for one resource while accessing another, leading to unauthorized data access or actions.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, which may violate compliance requirements under GDPR (data protection) or HIPAA (health information privacy). Unauthorized resource access could result in data breaches, triggering legal and regulatory penalties.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Nuxt.js to version 4.6.2 or later to apply the official fix. If upgrading is not immediately possible, implement a workaround by reading route parameters from a single source or rejecting requests containing %3F in server middleware.

Useful 0 Not Useful 0