Path Parsing Vulnerability in Nuxt Framework by Nuxt.js

CVE-2026-128077

What is CVE-2026-128077?

Nuxt is a powerful open-source web development framework built on Vue.js. Versions 4.6.0 to 4.6.4 contain a vulnerability where a request path starting with '//' is misinterpreted as a URL host. This can lead to unauthorized access to sensitive pages such as /admin without proper route authentication, as server/middleware checks and security measures may be bypassed. Successful exploitation allows an attacker to directly access administrative interfaces without any protective constraints in place. This vulnerability was addressed in version 4.6.4.

References