CVE-2026-114132: Case-Sensitivity Route Rule Bypass in Nuxt Framework

Vulnerability ID: CVE-2026-114132
CVSS Score: 6.3
Published: 2026-10-22

Nuxt versions prior to 4.6.2 suffer from a route rule bypass vulnerability caused by an architectural mismatch in case-sensitivity handling between the Nitro server runtime and the Vue page router. An unauthenticated remote attacker can bypass server-enforced route directives—such as redirects, security headers, and SSR controls—by altering character casing in HTTP request paths.

TL;DR

A case-sensitivity mismatch between Nitro server route rules and the Nuxt Vue page router allows attackers to bypass security headers, redirects, and proxy rules by requesting paths with altered casing (e.g., /Admin/secret instead of /admin/secret).

⚠️ Exploit Status: POC

Technical Details

• CWE ID: CWE-178 / CWE-863
• CVSS v4.0 Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
• CVSS Score: 6.3 (Medium)
• EPSS Score: 0.00314 (23.05th percentile)
• Attack Vector: Network (Unauthenticated HTTP)
• Exploit Status: Proof of Concept in Fix Commit
• CISA KEV Status: Not Listed

Affected Systems

• Nuxt Framework (npm package nuxt versions >= 4.1.3 and < 4.6.2)
• nuxt: >= 4.1.3, < 4.6.2 (Fixed in: 4.6.2)

Code Analysis

Commit: f6cfee5

fix(nitro): normalize route rules case when matching paths

Exploit Details

• GitHub Fix Commit Test Suite: Integration test validating routeRules case-sensitivity normalization across URL path variations.

Mitigation Strategies

• Upgrade Nuxt framework dependencies to version 4.6.2 or later.
• Enforce case-sensitive path matching in nuxt.config.ts as an immediate workaround.
• Migrate sensitive authorization logic from routeRules to dedicated server/middleware functions.

Remediation Steps:

1. Update the project package.json to reference nuxt ^4.6.2.
2. Execute package manager installation commands (npm install / pnpm install / yarn install).
3. Verify that nuxt.config.ts does not override sensitive routing options incorrectly.
4. Redeploy the application bundle to update the Nitro server build output.

References

• GitHub Security Advisory GHSA-vjh5-4x84-xrqp
• Nuxt Fix Commit f6cfee52cf9576ddc4f4ee83b486969328b358f8
• Nuxt v4.6.2 Release
• CVE.org Record CVE-2026-114132
• NVD CVE-2026-114132 Detail

Read the full report for CVE-2026-114132 on our website for more details including interactive diagrams and full exploit analysis.