Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-114132— Nuxt: Server-side route rules (`redirect`, `headers`, `proxy`, `ssr`) are skipped for case-variant paths when routing is case-insensitive

Quick assessment

Affected
nuxt nuxt
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Nuxt 是一个用于 Vue.js 的开源 Web 开发框架。在 4.6.2 版本之前，Nuxt 默认以不区分大小写的方式解析页面路由，而 Nitro 则以区分大小写的方式匹配服务端路由规则（route-rule）的键名。这种不一致导致仅因字母大小写不同而发出的请求，可能绕过原本应为该页面配置的服务端规则。 该不匹配问题可能导致以下配置被跳过：重定向（redirect）、响应头（headers）、代理（proxy）、 以及 。同时， 和 函数在遇到大小写变体路径时，可能返回空规则。 若应用程序在 中设置了 ，则不受

CVSS 6.3 · Medium EPSS 0.31% · P23

Affected Version Matrix 1

VendorProduct Version RangeStatus
nuxt nuxt < 4.6.2 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-114132

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Nuxt: Server-side route rules (`redirect`, `headers`, `proxy`, `ssr`) are skipped for case-variant paths when routing is case-insensitive
Source: CVE Program / CVE List V5
Vulnerability Description
Nuxt is an open-source web development framework for Vue.js. Prior to 4.6.2, Nuxt resolves pages case-insensitively by default while Nitro matches server-side route-rule keys case-sensitively, allowing a request whose path differs only by letter case to render without the server rule intended for that page. The mismatch can skip redirect, headers, proxy, ssr: false, and noScripts, and can cause getRouteRules(event) and matchRouteRules to return no rule for the case variant. Applications that set router.options.sensitive: true in nuxt.config are not affected; setting sensitive only in app/router.options.ts does not establish this exclusion because the server follows the nuxt.config value. Access checks implemented in server middleware, page route middleware, or page data fetching remain independent of this matcher. This issue is fixed in version 4.6.2.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
大小写敏感处理不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
nuxt nuxt < 4.6.2 -

II. Public POCs for CVE-2026-114132

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-114132

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-114132 (1)

Vendor Advisories for CVE-2026-114132 (1)

Vendor Pages for CVE-2026-114132 (1)

Same Patch Batch · nuxt · 2026-10-21 · 4 CVEs total

CVE-2026-114131 6.5 MEDIUM Nuxt: Route rules are matched against the raw request path, so a percent-encoded segment c
CVE-2026-114133 5.4 MEDIUM Nuxt server islands render `useHeadSafe` input without sanitisation
CVE-2026-114130 2.3 LOW Nuxt: Incomplete fix for GHSA-934w-87qh-qr26: a `javascript:` URL prefixed with an ASCII c

IV. Related Vulnerabilities

Same product: nuxt
Same vendor: nuxt
Same weakness: CWE-178

V. Comments for CVE-2026-114132

No comments yet

Leave a comment