ZDF
Sign inSign up

Vulnerabilities

Security fix · CVE-2026-114132

Nuxt: Server-side route rules ( , , , ) are skipped for case-variant paths when routing is case-insensitive

Published Oct 21, 2026 · catalog updated Oct 22, 2026 · Nuxt: Server-side route rules

Last checked Oct 25, 2026. A connected source was read within the last 7 days.

Check if you run it

No confirmed exploitation is on record for CVE-2026-114132. EPSS is 0.42%. Act only if a listed version of Nuxt: Server-side route rules is installed.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (Nuxt: Server-side route rules).
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.

Same product and reporting

Severity
Medium6.3
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.42%
Remediation
Version ranges on file
Affected products
npm @nuxt · npm @nuxt/nitro-server · npm nuxt · package npm · vendor nuxt nuxt

## Impact With the default , Nuxt's page router resolves routes case-insensitively, so renders the same page as . On the server, however, route rules were resolved with Nitro's route-rule matcher, which matches keys case-sensitively. A request whose path differs from a rule key only in letter case therefore rendered the page with none of that rule applied. Earlier fixes ([GHSA-mm7m-92g8-7m47](https://github.com/nuxt/nuxt/security/advisories/GHSA-mm7m-92g8-7m47), [GHSA-hxvh-4h3w-prp9](https://github.com/nuxt/nuxt/security/advisories/GHSA-hxvh-4h3w-prp9)) case-folded the route rules that the Nuxt app itself reads, such as . This advisory covers the rules applied on the server: - : a rule used to send visitors away from a page, such as , was skipped, and the page and its server-fetched data were rendered instead. - : per-route response headers, including security headers such as or , were not sent. - : the request was not proxied. - and : the page was server-rendered, or shipped scripts, despite the rule. - (auto-imported, or from ) and from returned no rules for the case variant. With this configuration, redirects to , but rendered . ## Mitigating factors - Applications that set in are not affected, because their pages are only served for the exact case of the route. - Access checks performed in server middleware, route middleware attached with , or in the page's data fetching are not affected. The issue only affects protections that rely on a server-side route rule matching the request path. ## Affected versions , including all Nuxt 3 releases, and . ## Patches Fixed in . Nuxt 3 reached end of life on 31 July 2026 and will not receive a fix. Nuxt now resolves server-side route rules itself, decoding and case-folding both the rule keys and the request path unless is set, and applies the result to Nitro's , and handling, the renderer, and the / helpers. When routing is case-insensitive, patched releases change some behaviour: - Route rules also apply to case variants o

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • npm @nuxtversion unspecified
  • npm @nuxt/nitro-server>= 3.20.0, < 4.0.0
  • npm @nuxt/nitro-server>= 4.2.0, < 4.6.2
  • npm nuxt>= 3.0.0, < 4.0.0
  • npm nuxt>= 4.0.0, < 4.6.2
  • package npmversion unspecified
  • vendor nuxt nuxtversion unspecified

How to fix CVE-2026-114132

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-114132. EPSS is 0.42%. Act only if a listed version of Nuxt: Server-side route rules is installed.

Which versions are affected?

Compare what you have installed with >= 3.20.0, < 4.0.0, >= 4.2.0, < 4.6.2, >= 3.0.0, < 4.0.0, >= 4.0.0, < 4.6.2. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-178; CWE-863: Incorrect Authorization. EPSS 0.42%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 22, 2026 · GitHub Advisory Database

    Detected

    ## Impact With the default , Nuxt's page router resolves routes case-insensitively, so renders the same page as . On the server, however, route rules were resolved with Nitro's route-rule matcher, which matches keys case-sensitively. A request whose path differs from a rule key only in letter case therefore rendered the page with none of that rule applied. Earlier fixes ([GHSA-mm7m-92g8-7m47](http

  2. Oct 22, 2026 · GitHub Advisory Database

    Updated

    ## Impact With the default , Nuxt's page router resolves routes case-insensitively, so renders the same page as . On the server, however, route rules were resolved with Nitro's route-rule matcher, which matches keys case-sensitively. A request whose path differs from a rule key only in letter case therefore rendered the page with none of that rule applied. Earlier fixes ([GHSA-mm7m-92g8-7m47](http

Sources

  • CVE.orgVulnerability recordCVE-2026-114132

    Nuxt is an open-source web development framework for Vue.js. Prior to 4.6.2, Nuxt resolves pages case-insensitively by default while Nitro matches server-side route-rule keys case-sensitively, allowing a request whose path differs only by letter case to render without the server

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2026-114132

    30-day exploitation probability 0.42%

    first.org
  • GitHub Advisory DatabasePackage advisoryGHSA-vjh5-4x84-xrqp

    Nuxt: Server-side route rules ( , , , ) are skipped for case-variant paths when routing is case-insensitive

    github.com
  • GitLab Advisory DatabasePackage advisoryCVE-2026-114132

    With the default router.options.sensitive: false, Nuxt's page router resolves routes case-insensitively, so /Admin renders the same page as /admin. On the server, however, route rules were resolved with Nitro's route-rule matcher, which matches keys case-sensitively. A request whose path differs from a rule key only in letter case therefore rendered the page with none of that rule applied. Earlier

    advisories.gitlab.com
  • Snyk Vulnerability DatabasePackage advisorySNYK-JS-NUXT-21431483

    Incorrect Authorization

    security.snyk.io
  • Snyk Vulnerability DatabasePackage advisorySNYK-JS-NUXTNITROSERVER-21431482

    Incorrect Authorization

    security.snyk.io

References

Freshness

Last verified in this catalog Oct 25, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

  • FIRST EPSSOct 25, 2026
  • Snyk Vulnerability DatabaseOct 25, 2026
  • Snyk Vulnerability DatabaseOct 25, 2026
  • GitHub Advisory DatabaseOct 23, 2026
  • GitLab Advisory DatabaseOct 23, 2026
  • CVE.orgOct 23, 2026