---
id: CVE-2026-114131
title: >-
  Nuxt: Route rules are matched against the raw request path, so a
  percent-encoded segment can bypass `appMiddleware` on dynamic and catch-all
  routes
summary: >-
  Nuxt is an open-source web development framework for Vue.js. From 3.11.0 until
  3.21.4 and 4.4.4, Nuxt compares route-rule keys with the raw request path
  while route resolution decodes dynamic and catch-all parameters, allowing a
  percent-…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-436
  - CWE-863
vendor: nuxt
product: nuxt
affected:
  - 'nuxt >= 4.0.0, < 4.4.4'
  - 'nuxt >= 3.11.0, < 3.21.4'
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-30T17:48:43.512590Z'
published: '2026-10-21'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T17:48:52.857Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-114131'
references:
  - url: 'https://github.com/nuxt/nuxt/security/advisories/GHSA-6gq8-jgmh-3ffp'
    label: 'https://github.com/nuxt/nuxt/security/advisories/GHSA-6gq8-jgmh-3ffp'
  - url: >-
      https://github.com/nuxt/nuxt/commit/81f86ac5ee82bb1a9b887e59f3bc84624d711497
    label: >-
      https://github.com/nuxt/nuxt/commit/81f86ac5ee82bb1a9b887e59f3bc84624d711497
  - url: >-
      https://github.com/nuxt/nuxt/commit/9123ed850c468a7424a868c20d0d49a5507d32e5
    label: >-
      https://github.com/nuxt/nuxt/commit/9123ed850c468a7424a868c20d0d49a5507d32e5
  - url: 'https://github.com/nuxt/nuxt/releases/tag/v3.21.11'
    label: 'https://github.com/nuxt/nuxt/releases/tag/v3.21.11'
  - url: 'https://github.com/nuxt/nuxt/releases/tag/v4.5.2'
    label: 'https://github.com/nuxt/nuxt/releases/tag/v4.5.2'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-114131'
  - url: 'https://github.com/advisories/GHSA-6gq8-jgmh-3ffp'
tags:
  - cve.org
  - ghsa
  - npm
epss: 0.00363
epssPercentile: 0.30291
aliases:
  - GHSA-6gq8-jgmh-3ffp
ecosystem: npm
patched:
  - nuxt 4.4.4
  - nuxt 3.21.4
ingestedAt: '2026-10-21T18:09:27.274Z'
---

## Overview

Nuxt is an open-source web development framework for Vue.js. From 3.11.0 until 3.21.4 and 4.4.4, Nuxt compares route-rule keys with the raw request path while route resolution decodes dynamic and catch-all parameters, allowing a percent-encoded segment to resolve to a protected page without matching the routeRules entry intended for that path. As a result, appMiddleware can be skipped during server rendering and an unauthenticated requester can receive the gated page and its SSR data. The same mismatch affects app-manifest rules including redirect, appLayout, ssr, prerender, and payload flags derived from cache, isr, and swr. This vulnerability is fixed in 4.4.4 and 3.21.4.

## Affected

- `nuxt >= 4.0.0, < 4.4.4`
- `nuxt >= 3.11.0, < 3.21.4`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-114131)

Affected packages:

- `nuxt >= 4.0.0, < 4.4.4`
- `nuxt >= 3.11.0, < 3.21.4`

Patched in:

- `nuxt 4.4.4`
- `nuxt 3.21.4`

Source: https://github.com/advisories/GHSA-6gq8-jgmh-3ffp