6.5
MediumCVSS 3.1 · from GitHub_M
CVE-2026-119200
Nuxt: Dot segments in the request path bypass `server/middleware` path checks and server route rules on page routes
nuxt · CWE-41 · CWE-41Affectednuxt, nitro-server
FixNo fix listed yet.
PublishedOct 29, 20:17 · GitHub_M
ScoredOct 29 · 6.5 · GitHub_M
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:04 UTC
What we know
No known exploitation. CISA KEV, checked 22:04 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker only needs network access to the target. No login needed. CVSS: network, no privileges.
Description
Nuxt is an open-source web development framework for Vue.js. From 4.6.0 until 4.6.3, Nuxt resolves literal or percent-encoded dot segments before rendering a page while Nitro routing, server/middleware checks, and server route rules evaluate the unresolved path. A request such as /%2e/admin can therefore render app/pages/admin.vue and its server-rendered data while checks keyed to /admin, redirects, or per-route security headers do not apply. API handlers, appMiddleware, Nuxt 3, and Nuxt 4.0.0 through 4.5.x are not affected, and exploitation requires a client that sends dot segments without browser normalization. This issue is fixed in version 4.6.3.
From GitHub_M
Affected and fixed versions
ProductAffectedFixed innuxt>= 4.6.0, < 4.6.3–nitro-server>= 4.6.0, < 4.6.3–
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known