DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-114132: CVE-2026-114132: Case-Sensitivity Route Rule Bypass in Nuxt Framework

#security #cve #cybersecurity

CVE-2026-114132: Case-Sensitivity Route Rule Bypass in Nuxt Framework

Vulnerability ID: CVE-2026-114132
CVSS Score: 6.3
Published: 2026-10-22

Nuxt versions prior to 4.6.2 suffer from a route rule bypass vulnerability caused by an architectural mismatch in case-sensitivity handling between the Nitro server runtime and the Vue page router. An unauthenticated remote attacker can bypass server-enforced route directives—such as redirects, security headers, and SSR controls—by altering character casing in HTTP request paths.

TL;DR

A case-sensitivity mismatch between Nitro server route rules and the Nuxt Vue page router allows attackers to bypass security headers, redirects, and proxy rules by requesting paths with altered casing (e.g., /Admin/secret instead of /admin/secret).

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-178 / CWE-863
  • CVSS v4.0 Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
  • CVSS Score: 6.3 (Medium)
  • EPSS Score: 0.00314 (23.05th percentile)
  • Attack Vector: Network (Unauthenticated HTTP)
  • Exploit Status: Proof of Concept in Fix Commit
  • CISA KEV Status: Not Listed

Affected Systems

  • Nuxt Framework (npm package nuxt versions >= 4.1.3 and < 4.6.2)
  • nuxt: >= 4.1.3, < 4.6.2 (Fixed in: 4.6.2)

Code Analysis

Commit: f6cfee5

fix(nitro): normalize route rules case when matching paths

Exploit Details

Mitigation Strategies

  • Upgrade Nuxt framework dependencies to version 4.6.2 or later.
  • Enforce case-sensitive path matching in nuxt.config.ts as an immediate workaround.
  • Migrate sensitive authorization logic from routeRules to dedicated server/middleware functions.

Remediation Steps:

  1. Update the project package.json to reference nuxt ^4.6.2.
  2. Execute package manager installation commands (npm install / pnpm install / yarn install).
  3. Verify that nuxt.config.ts does not override sensitive routing options incorrectly.
  4. Redeploy the application bundle to update the Nitro server build output.

References

Read the full report for CVE-2026-114132 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)