Route Resolution Vulnerability in Nuxt Framework by Nuxt

CVE-2026-114131

What is CVE-2026-114131?

The Nuxt framework, spanning versions 3.11.0 to 3.21.4 and 4.4.4, presents an issue where the framework's route resolution process improperly handles percent-encoded segments. This allows unauthorized users to potentially access protected pages and server-side rendered data without proper authentication. The flawed route-rule comparison with the raw request path leads to a scenario where appMiddleware can be bypassed, disrupting security measures. Furthermore, this mismatch extends to critical app-manifest rules, impacting various flags related to caching and rendering. Updates are available in versions 3.21.4 and 4.4.4 to mitigate these security concerns.

References