CVE-2026-128071

Nuxt is an open-source web development framework for Vue.js. Nuxt from 3.0.0 until 4.6.4, @nuxt/nitro-server from 3.20.0 until 4.6.4, and @nuxt/vite-server from 4.6.0 until 4.6.4, routeRules matching leaves an encoded slash (%2F) in the request path while a catch-all page such as app/pages/[...slug].vue or a custom multi-segment page route decodes it into a route parameter. The getRouteRules result is therefore incomplete, and an unauthenticated request can render the page without the redirect, headers, proxy, SSR, noScripts, appMiddleware, or appLayout rules configured for the decoded path. Protected content is resolved only when the page interprets the decoded parameter accordingly: a custom multi-segment parameter can contain the decoded path, while a repeatable catch-all must join the slash-containing array element; route.path remains encoded and does not resolve that resource. Static pages, single-segment parameters, server/api handlers, and server/routes handlers are not affected because they do not have the same encoded-path mismatch. This issue is fixed in version 4.6.4.

• CWE-436
• CWE-863

• https://github.com/nuxt/nuxt/commit/084396b101e3b4d3545e86ff80dc313496bc87c0
• https://github.com/nuxt/nuxt/releases/tag/v4.6.4
• https://github.com/nuxt/nuxt/security/advisories/GHSA-f3x9-2chm-73c8

Published

Nov 13, 2026

Last Modified

Nov 13, 2026

Status

Awaiting Analysis

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-128066Pillow is a Python imaging library. From 1.0 through 12.3.0,…8.7
• CVE-2026-128067Pillow is a Python imaging library. From 2.3.0 through 12.3.…8.4
• CVE-2026-128068rails-html-sanitizer is responsible for sanitizing HTML frag…5.3
• CVE-2026-128069rails-html-sanitizer is responsible for sanitizing HTML frag…4.7
• CVE-2026-12807A vulnerability was found in Edimax BR-6478AC V2 1.23. This …6.3
• CVE-2026-128070Nuxt is an open-source web development framework for Vue.js.…5.9
• CVE-2026-128072Nuxt is an open-source web development framework for Vue.js.…3.1
• CVE-2026-128074Nuxt is an open-source web development framework for Vue.js.…6.9
• CVE-2026-128075Nuxt is an open-source web development framework for Vue.js.…5.3
• CVE-2026-128076Nuxt is an open-source web development framework for Vue.js.…3.1
• CVE-2026-128077Nuxt is an open-source web development framework for Vue.js.…6.5
• CVE-2026-128078GLPI is a free asset and IT management software package. Fro…5.3