ZDF
Sign inSign up

Vulnerabilities

Security fix · CVE-2026-119200

Nuxt: Dot segments in the request path bypass path checks and server route rules on page routes

Published Oct 27, 2026 · catalog updated Oct 30, 2026 · Nuxt: Dot segments in

Last checked Nov 2, 2026. A connected source was read within the last 7 days.

Check if you run it

No confirmed exploitation is on record for CVE-2026-119200. EPSS is 0.34%. Act only if a listed version of Nuxt: Dot segments in is installed.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (Nuxt: Dot segments in).
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
Medium6.5
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.34%
Remediation
Version ranges on file
Affected products
npm @nuxt · npm @nuxt/nitro-server · npm nuxt

### Summary Since , Nuxt resolves and segments in the request path, including percent-encoded forms such as , before rendering a page. Nitro's routing, Nitro's route rules and see the path with those segments still in place. A request for therefore renders the page at , while server-side checks keyed on do not apply. ### Impact An unauthenticated attacker can bypass server-side controls that match on the request path of a page route. that checks (or ) is skipped: With this middleware, returns 401, but , and reach the middleware with set to , and , and render along with the data it fetches during server rendering. Server-side and route rules are skipped in the same way, so does not redirect , and per-route security headers such as are not sent. Not affected: - API handlers in and . Nitro's router does not resolve dot segments, so these requests do not reach the handler. - route rules and middleware declared with , which are matched against the resolved route. - Nuxt and to , which pass the path to the page router unchanged, so these requests 404. Browsers resolve dot segments before sending a request, so exploitation requires a client that sends the path as written. ### Patches Fixed in and . A page request whose path contains or segments now receives a 404 instead of rendering the page the path resolves to, and route-rule keys and lookup paths have their dot segments resolved, including percent-encoded spellings, before they are compared. ### Workarounds Reject dot segments in a server middleware that runs before your other middleware (middleware runs in file name order): Checking instead of is not a sufficient workaround: it resolves dot segments, but keeps percent-encoding such as that the page router decodes. Path checks in server middleware should also account for the page router matching paths case-insensitively unless is set. A reverse proxy or CDN that normalises the request path before forwarding it also removes the mismatch. ### Credits Thanks to @vinzabe,

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • npm @nuxtversion unspecified
  • npm @nuxt/nitro-server>= 4.6.0 < 4.6.3
  • npm @nuxt/nitro-server>= 4.6.0, < 4.6.3
  • npm nuxt>= 4.6.0 < 4.6.3
  • npm nuxt>= 4.6.0, < 4.6.3

How to fix CVE-2026-119200

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-119200. EPSS is 0.34%. Act only if a listed version of Nuxt: Dot segments in is installed.

Which versions are affected?

Compare what you have installed with >= 4.6.0 < 4.6.3, >= 4.6.0, < 4.6.3. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-41; CWE-436; CWE-863: Incorrect Authorization. EPSS 0.34%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Technology hubs

Nuxt security

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 30, 2026 · GitHub Advisory Database

    Detected

    ### Summary Since , Nuxt resolves and segments in the request path, including percent-encoded forms such as , before rendering a page. Nitro's routing, Nitro's route rules and see the path with those segments still in place. A request for therefore renders the page at , while server-side checks keyed on do not apply. ### Impact An unauthenticated attacker can bypass server-side controls that match

  2. Oct 30, 2026 · GitHub Advisory Database

    Updated

    ### Summary Since , Nuxt resolves and segments in the request path, including percent-encoded forms such as , before rendering a page. Nitro's routing, Nitro's route rules and see the path with those segments still in place. A request for therefore renders the page at , while server-side checks keyed on do not apply. ### Impact An unauthenticated attacker can bypass server-side controls that match

Sources

  • CVE.orgVulnerability recordCVE-2026-119200

    Official CVE identifier

    cve.org
  • GitHub Advisory DatabasePackage advisoryGHSA-9v7c-q64q-vv33

    Nuxt: Dot segments in the request path bypass path checks and server route rules on page routes

    github.com
  • GitLab Advisory DatabasePackage advisoryCVE-2026-119200

    Since 4.6.0, Nuxt resolves . and .. segments in the request path, including percent-encoded forms such as %2e, before rendering a page. Nitro's routing, Nitro's route rules and server/middleware see the path with those segments still in place. A request for /%2e/admin therefore renders the page at /admin, while server-side checks keyed on /admin do not apply.

    advisories.gitlab.com
  • Maintainer security tabsVendor advisoryGHSA-9v7c-q64q-vv33

    ### Summary Since , Nuxt resolves and segments in the request path, including percent-encoded forms such as , before rendering a page. Nitro's routing, Nitro's route rules and see the path with those segments still in place. A request for therefore renders the page at , while server-side checks keyed on do not apply. ### Impact An unauthenticated attacker can bypass server-side controls that match

    github.com

References

Freshness

Last verified in this catalog Oct 31, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

  • Maintainer security tabsNov 2, 2026
  • GitLab Advisory DatabaseNov 1, 2026
  • CVE.orgOct 31, 2026
  • GitHub Advisory DatabaseOct 31, 2026