CVE-2026-128074
Awaiting Analysis Awaiting Analysis - Queue

Nuxt.js Path Traversal via Trailing Slash Regex

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: GitHub, Inc.

Description
Nuxt is an open-source web development framework for Vue.js. From 4.6.0 until 4.6.4, _payload.json URL generation and the experimental early-404 path use a trailing-slash regular expression whose work grows quadratically with a long run of slash characters. An unauthenticated request can synchronously occupy the Node.js event loop and delay other requests when server-side rendering uses isr, swr, or cache route rules, or when experimental.early404 is enabled. Applications without those route rules and without experimental.early404, fully prerendered applications, and client-only applications are unaffected; the impact is limited to availability. This issue is fixed in version 4.6.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-128074
EUVD
EUVD-2026-125625

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
nuxt nuxt From 4.6.0 (inc) to 4.6.4 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1333 The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Nuxt versions 4.6.0 through 4.6.3. It involves a performance issue where a single unauthenticated request with a long sequence of repeated slashes in the path can delay the server's event loop. The issue occurs because Nuxt uses a regular expression to strip trailing slashes from request paths, which has quadratic computational complexity. This can cause delays for other concurrent requests in the same process.

Detection Guidance

To detect this vulnerability, monitor for unusually slow responses or high CPU usage when processing URLs with long sequences of slashes. Check if your Nuxt application uses server-side rendering with ISR, SWR, or cache route rules, or has experimental.early404 enabled. Test by sending a request with a path containing many repeated slashes (e.g., /a/../a/../a/...).

Commands to check Nuxt version and configurations: npm list nuxt or cat package.json. Inspect server logs for slow requests or timeouts during payload extraction.

Impact Analysis

The vulnerability can lead to denial-of-service conditions by slowing down or blocking other requests due to excessive CPU usage. It specifically impacts applications using server-side rendering with route rules like ISR, SWR, or cache, or those with the experimental.early404 option enabled. Applications without these configurations or using prerendering or client-only rendering are unaffected.

Mitigation Strategies

Upgrade Nuxt to version 4.6.4 or later to patch the issue. If upgrading is not immediate, disable experimental.early404 or implement a reverse proxy to reject paths with repeated slashes. Add middleware to sanitize input paths before processing.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-128074. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...