CVE-2026-119200— Nuxt: Dot segments in the request path bypass `server/middleware` path checks and server route rules on page routes

Quick assessment

Affected

nuxt nuxt

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Nuxt 是一个基于 Vue.js 的开源 Web 开发框架。在版本 4.6.0 至 4.6.3 期间，Nuxt 在渲染页面之前会解析字面量或经过百分号编码的“点”路径段（dot segments），而 Nitro 路由、服务端中间件检查以及服务端路由规则却仍基于未解析的路径进行评估。因此，类似的请求可能会渲染及其服务端渲染数据，但原本针对路径设置的检查、重定向或每路由安全标头却不会生效。API 处理器、、Nuxt 3 以及 Nuxt 4.0.0 至 4.5.x 版本不受此问题影响；此外，利用该漏洞需要客户

CVSS 6.5 · Medium Updated Oct 30, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Nuxt: Dot segments in the request path bypass `server/middleware` path checks and server route rules on page routes

Source: CVE Program / CVE List V5

Vulnerability Description

Nuxt is an open-source web development framework for Vue.js. From 4.6.0 until 4.6.3, Nuxt resolves literal or percent-encoded dot segments before rendering a page while Nitro routing, server/middleware checks, and server route rules evaluate the unresolved path. A request such as /%2e/admin can therefore render app/pages/admin.vue and its server-rendered data while checks keyed to /admin, redirects, or per-route security headers do not apply. API handlers, appMiddleware, Nuxt 3, and Nuxt 4.0.0 through 4.5.x are not affected, and exploitation requires a client that sends dot segments without browser normalization. This issue is fixed in version 4.6.3.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

对路径等价的解析不恰当

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
nuxt	nuxt	>= 4.6.0, < 4.6.3	-
@nuxt	nitro-server	>= 4.6.0, < 4.6.3	-

II. Public POCs for CVE-2026-119200

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-119200

请登录查看更多情报信息。

Other References for CVE-2026-119200 (3)

https://github.com/nuxt/nuxt/releases/tag/v4.6.3 x_refsource_MISC
https://github.com/nuxt/nuxt/security/advisories/GHSA-9v7c-q64q-vv33 x_refsource_CONFIRM
https://github.com/nuxt/nuxt/commit/45463f8b58487e387149ebfb704d6a0834b3a450 x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-119200

Same Patch Batch · nuxt · 2026-10-29 · 4 CVEs total

CVE-2026-119198	5.9 MEDIUM	Nuxt dev server arbitrary file read through client error reports
CVE-2026-119199	5.9 MEDIUM	Nuxt dev server exposes private runtime config through the Nitro dev bundle
CVE-2026-119201	4.8 MEDIUM	Nuxt dev server exposes generated appSecret through Vite file serving

IV. Related Vulnerabilities

Same product: nuxt

Same vendor: nuxt

Same weakness: CWE-41