Multiple security vulnerabilities have been identified in the Nuxt framework, affecting versions from 3.0.0 up to 4.6.1. These flaws impact route rule matching, link rendering, and server island head sanitisation, creating risks for unauthorised access, cross-site scripting, and bypassed security controls. The overall risk is moderate to high, depending on application configuration and user input handling.
CVE-2026-114131 (CVSS 6.5 — Medium): This flaw allows percent-encoded path segments to bypass appMiddleware on dynamic and catch-all routes because route rules are matched against the raw request path rather than the decoded path. An unauthenticated attacker can exploit this by crafting a request with encoded characters to access protected pages without triggering the required middleware.[/subscribe_to_unlock_form]
Multiple security vulnerabilities have been identified in the Nuxt framework, affecting versions from 3.0.0 up to 4.6.1. These flaws impact route rule matching, link rendering, and server island head sanitisation, creating risks for unauthorised access, cross-site scripting, and bypassed security controls. The overall risk is moderate to high, depending on application configuration and user input handling.
CVE-2026-114131 (CVSS 6.5 — Medium): This flaw allows percent-encoded path segments to bypass appMiddleware on dynamic and catch-all routes because route rules are matched against the raw request path rather than the decoded path. An unauthenticated attacker can exploit this by crafting a request with encoded characters to access protected pages without triggering the required middleware.[emaillocker id="1283"]
CVE-2026-114130 (CVSS 2.3 — Low): An incomplete fix for a previous vulnerability allows a javascript: URL prefixed with an ASCII control character to execute from a NuxtLink component when the pages option is disabled. This results in cross-site scripting if an application binds untrusted input to the link target and a victim clicks the rendered link.
CVE-2026-53722: This vulnerability is referenced as the predecessor to the incomplete fix described in CVE-2026-114130, involving script execution from link components. The specific technical details and CVSS score for this identifier are not provided in the available advisory data.
CVE-2026-114133 (CVSS 5.4 — Medium): Server islands render useHeadSafe input without proper sanitisation, allowing unsafe attributes and script tags to be included in the page head. An attacker who controls data passed to useHeadSafe within a server island can achieve stored cross-site scripting on the application's origin.
CVE-2026-114132 (CVSS 6.3 — Medium): Server-side route rules such as redirect, headers, and proxy are skipped for case-variant paths when routing is configured as case-insensitive. This mismatch allows attackers to bypass security headers, redirects, and proxy settings by altering the letter case of the request path, potentially exposing sensitive data or disabling protective measures.
These vulnerabilities collectively present a significant risk to applications relying on Nuxt for routing, security headers, and input sanitisation. Developers and administrators are most at risk if they use dynamic routes, server islands, or case-insensitive routing without additional protective measures. The general action is to review application configurations and ensure that security controls are enforced at the application logic level rather than relying solely on framework route rules.
We recommend you to update Nuxt to version 4.6.2 or 3.21.4 depending on your installed branch.
The following reports contain further technical details:
[/emaillocker]