Path Parameter Handling Issue in Nuxt Framework by NuxtJS
CVE-2026-128071
6.5MEDIUM
What is CVE-2026-128071?
A vulnerability in the Nuxt framework allows unauthenticated requests to render pages due to improper handling of encoded slashes in route paths. This results in incomplete route rule applications and can expose protected content inadvertently. While static pages and server handlers are safeguarded, pages with custom parameters may experience exposure. The issue has been addressed in Nuxt's version 4.6.4, so upgrading is essential to maintain security.
Affected Version(s)
nitro-server >= 3.20.0, < 4.0.0 < 3.20.0, 4.0.0
nitro-server >= 4.2.0, < 4.6.4 < 4.2.0, 4.6.4
nuxt >= 3.0.0, < 4.6.4