{"id":"CVE-2026-114131","summary":"Nuxt: Route rules are matched against the raw request path, so a percent-encoded segment can bypass `appMiddleware` on dynamic and catch-all routes","details":"Nuxt is an open-source web development framework for Vue.js. From 3.11.0 until 3.21.4 and 4.4.4, Nuxt compares route-rule keys with the raw request path while route resolution decodes dynamic and catch-all parameters, allowing a percent-encoded segment to resolve to a protected page without matching the routeRules entry intended for that path. As a result, appMiddleware can be skipped during server rendering and an unauthenticated requester can receive the gated page and its SSR data. The same mismatch affects app-manifest rules including redirect, appLayout, ssr, prerender, and payload flags derived from cache, isr, and swr. This vulnerability is fixed in 4.4.4 and 3.21.4.","aliases":["GHSA-6gq8-jgmh-3ffp"],"modified":"2026-10-22T02:49:12.801925171Z","published":"2026-10-21T17:41:24.016Z","database_specific":{"cwe_ids":["CWE-436","CWE-863"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/114xxx/CVE-2026-114131.json","cna_assigner":"GitHub_M"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/114xxx/CVE-2026-114131.json"},{"type":"FIX","url":"https://github.com/nuxt/nuxt/commit/81f86ac5ee82bb1a9b887e59f3bc84624d711497"},{"type":"FIX","url":"https://github.com/nuxt/nuxt/commit/9123ed850c468a7424a868c20d0d49a5507d32e5"},{"type":"WEB","url":"https://github.com/nuxt/nuxt/releases/tag/v3.21.11"},{"type":"WEB","url":"https://github.com/nuxt/nuxt/releases/tag/v4.5.2"},{"type":"ADVISORY","url":"https://github.com/nuxt/nuxt/security/advisories/GHSA-6gq8-jgmh-3ffp"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114131"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/nuxt/nuxt","events":[{"introduced":"8aacdde48e8388c8bb11b9a5c2f59935341bfcfd"},{"fixed":"7f8443d72d1c4bc8703d3ccf60c156d1335fda74"},{"introduced":"78d5098c28d2e21622961d8b87ef9b4623194fec"},{"fixed":"20abe11fcab0461633840ad8437be23406e996f7"},{"fixed":"81f86ac5ee82bb1a9b887e59f3bc84624d711497"},{"fixed":"9123ed850c468a7424a868c20d0d49a5507d32e5"},{"fixed":"e0a6ae9d5d68068f0d9108b385c6bb4c7f98fd4b"},{"fixed":"e2d3a3945a3459c0e3a869de85c0b53c6c214432"}],"database_specific":{"extracted_events":[{"range":[{"introduced":"4.0.0"},{"fixed":"4.4.4"}],"source":"AFFECTED_FIELD","strategy":"StringRangeExpression"},{"strategy":"StringRangeExpression","range":[{"introduced":"3.11.0"},{"fixed":"3.21.4"}],"source":"AFFECTED_FIELD"},{"range":[{"fixed":"81f86ac5ee82bb1a9b887e59f3bc84624d711497"}],"source":"REFERENCES_COMMIT"},{"source":"REFERENCES_COMMIT","range":[{"fixed":"9123ed850c468a7424a868c20d0d49a5507d32e5"}]},{"source":"REFERENCES_TAG","original_tag":"v3.21.11","range":[{"fixed":"e0a6ae9d5d68068f0d9108b385c6bb4c7f98fd4b"}]},{"range":[{"fixed":"e2d3a3945a3459c0e3a869de85c0b53c6c214432"}],"source":"REFERENCES_TAG","original_tag":"v4.5.2"}]}}],"versions":["v3.21.3","v4.4.3","v4.4.2","v3.21.2","v4.4.1","v4.4.0","v4.3.1","v3.21.1","v3.21.0","v4.3.0","v3.20.2","v4.2.2","v3.20.1","v4.2.1","v3.20.0","v4.2.0","v3.19.3","v4.1.3","v3.19.2","v4.1.2","v3.19.1","v4.1.1","v3.19.0","v4.1.0","v3.18.1","v4.0.3","v3.18.0","v4.0.2","v4.0.1","v4.0.0","v3.17.7","v3.17.6","v3.17.5","v3.17.4","v3.17.3","v3.17.2","v3.17.1","v3.17.0","v3.16.2","v3.16.1","v3.16.0","v3.15.4","v3.15.3","v3.15.2","v3.15.1","v3.15.0","v3.14.1592","v3.14.159","v3.14.0","v3.13.2","v3.13.1","v3.13.0","v3.12.4","v3.12.3","v3.12.2","v3.12.1","v3.12.0","v3.11.2","v3.11.1","v3.11.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-114131.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"}]}