CVE-2026-114131: Nuxt Route Rules appMiddleware Bypass via Percent-Encoded Route Segments

Vulnerability ID: CVE-2026-114131
CVSS Score: 6.5
Published: 2026-10-22

Nuxt versions 3.11.0 through 3.21.3 and 4.0.0 through 4.4.3 contain an interpretation conflict between the route rules matching engine and the core page routing mechanism. By submitting percent-encoded request path segments, unauthenticated attackers can bypass route rules, including appMiddleware authorization guards, and access rendered server-side page payloads.

TL;DR

An interpretation conflict in Nuxt allows unauthenticated users to bypass route rules and appMiddleware by sending percent-encoded URLs, leading to unauthorized access to server-side rendered page content.

⚠️ Exploit Status: POC

Technical Details

• CWE ID: CWE-436 / CWE-863
• Attack Vector: Network (Unauthenticated)
• CVSS v3.1 Score: 6.5 (Medium)
• EPSS Score: 0.00289 (~20th percentile)
• Impact: Middleware Bypass / SSR Data Confidentiality Loss
• Exploit Status: Proof-of-Concept Available
• CISA KEV Status: Not Listed

Affected Systems

• Nuxt 3.x deployments (versions >= 3.11.0 and < 3.21.4)
• Nuxt 4.x deployments (versions >= 4.0.0 and < 4.4.4)
• Web applications relying on routeRules appMiddleware for authentication guards
• nuxt: >= 3.11.0, < 3.21.4 (Fixed in: 3.21.4)
• nuxt: >= 4.0.0, < 4.4.4 (Fixed in: 4.4.4)

Code Analysis

Commit: 81f86ac

fix(nuxt): decode percent-encoded paths for route rules matching

Commit: 9123ed8

test(nuxt): add unicode and percent-encoded route rule unit tests

Exploit Details

• GitHub Security Advisory: Security advisory detailing percent-encoded route segment routeRules bypass.

Mitigation Strategies

• Upgrade the Nuxt package to a non-vulnerable version.
• Normalize URI paths at reverse proxy or WAF boundaries prior to upstream server forwarding.
• Enforce authorization checks inside server API routes and page inline guards.

Remediation Steps:

1. Update package dependencies in package.json to nuxt version >= 3.21.4 or >= 4.4.4.
2. Run npm install or pnpm install to apply the updated dependency package.
3. Verify that route-rule matching succeeds for percent-encoded paths in test environments.

References

• GitHub Security Advisory GHSA-6gq8-jgmh-3ffp
• NVD Vulnerability Details CVE-2026-114131
• Nuxt Patch Commit 81f86ac
• Nuxt Test Commit 9123ed8

Read the full report for CVE-2026-114131 on our website for more details including interactive diagrams and full exploit analysis.