CVE-2026-128071
Awaiting Analysis Awaiting Analysis - Queue

Path Traversal in Nuxt.js Framework

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: GitHub, Inc.

Description
Nuxt is an open-source web development framework for Vue.js. Nuxt from 3.0.0 until 4.6.4, @nuxt/nitro-server from 3.20.0 until 4.6.4, and @nuxt/vite-server from 4.6.0 until 4.6.4, routeRules matching leaves an encoded slash (%2F) in the request path while a catch-all page such as app/pages/[...slug].vue or a custom multi-segment page route decodes it into a route parameter. The getRouteRules result is therefore incomplete, and an unauthenticated request can render the page without the redirect, headers, proxy, SSR, noScripts, appMiddleware, or appLayout rules configured for the decoded path. Protected content is resolved only when the page interprets the decoded parameter accordingly: a custom multi-segment parameter can contain the decoded path, while a repeatable catch-all must join the slash-containing array element; route.path remains encoded and does not resolve that resource. Static pages, single-segment parameters, server/api handlers, and server/routes handlers are not affected because they do not have the same encoded-path mismatch. This issue is fixed in version 4.6.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-128071
EUVD
EUVD-2026-125622

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
nuxt nuxt From 3.0.0 (inc) to 4.6.4 (inc)
nuxt @nuxt From 3.20.0 (inc) to 4.6.4 (inc)
nuxt @nuxt From 4.6.0 (inc) to 4.6.4 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-436 Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state.
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Nuxt.js versions between 3.0.0 and 4.6.4. It involves encoded slashes (%2F) in request paths bypassing route rules on catch-all page routes. Normally, route rules match against the encoded path while the page router decodes it into parameters. This mismatch allows unauthenticated requests to render pages without intended protections like authentication, headers, or redirects.

Detection Guidance

To detect this vulnerability, check Nuxt.js versions in use. Run commands like 'npm list nuxt' or 'yarn list nuxt' to identify versions between 3.0.0-4.6.3. Inspect server logs for requests with encoded slashes (%2F) in paths, especially on catch-all routes like app/pages/[...slug].vue. Test if route rules are bypassed by accessing paths like /docs/internal%2Fguide and verifying if protections are missing.

Impact Analysis

An attacker could exploit this to bypass security rules, access protected content without authentication, or manipulate headers and redirects. For example, a rule protecting /admin/** would not apply to /admin%2Fsecret, potentially exposing sensitive pages. Static pages and single-segment parameters are not affected.

Mitigation Strategies

Upgrade Nuxt.js to version 4.6.4 or later immediately. If upgrading is not possible, implement server middleware to reject requests containing %2F in paths. Add validation in your web server (e.g., Nginx, Apache) to block encoded slashes in URLs. Review and update route rules to ensure they cover all possible path variations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-128071. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...