{"id":"CVE-2026-114132","kind":"vulnerability","aliases":["CVE-2026-114132","GHSA-vjh5-4x84-xrqp"],"related":[],"title":"Nuxt: Server-side route rules (`redirect`, `headers`, `proxy`, `ssr`) are skipped for case-variant paths when routing is case-insensitive","description":"## Impact\n\nWith the default `router.options.sensitive: false`, Nuxt's page router resolves routes case-insensitively, so `/Admin` renders the same page as `/admin`. On the server, however, route rules were resolved with Nitro's route-rule matcher, which matches keys case-sensitively. A request whose path differs from a rule key only in letter case therefore rendered the page with none of that rule applied.\n\nEarlier fixes ([GHSA-mm7m-92g8-7m47](https://github.com/nuxt/nuxt/security/advisories/GHSA-mm7m-92g8-7m47), [GHSA-hxvh-4h3w-prp9](https://github.com/nuxt/nuxt/security/advisories/GHSA-hxvh-4h3w-prp9)) case-folded the route rules that the Nuxt app itself reads, such as `appMiddleware`. This advisory covers the rules applied on the server:\n\n- `redirect`: a rule used to send visitors away from a page, such as `'/admin/**': { redirect: '/login' }`, was skipped, and the page and its server-fetched data were rendered instead.\n- `headers`: per-route response headers, including security headers such as `Content-Security-Policy` or `X-Frame-Options`, were not sent.\n- `proxy`: the request was not proxied.\n- `ssr: false` and `noScripts`: the page was server-rendered, or shipped scripts, despite the rule.\n- `getRouteRules(event)` (auto-imported, or from `nuxt/server`) and `matchRouteRules` from `nuxt/server` returned no rules for the case variant.\n\n```ts\nexport default defineNuxtConfig({\n  routeRules: {\n    '/admin/**': { redirect: '/login' },\n  },\n})\n```\n\nWith this configuration, `/admin/secret` redirects to `/login`, but `/Admin/secret` rendered `app/pages/admin/secret.vue`.\n\n## Mitigating factors\n\n- Applications that set `router.options.sensitive: true` in `nuxt.config` are not affected, because their pages are only served for the exact case of the route.\n- Access checks performed in server middleware, route middleware attached with `definePageMeta`, or in the page's data fetching are not affected. The issue only affects protections that rely on a server-side route rule matching the request path.\n\n## Affected versions\n\n`nuxt` `<4.6.2`, including all Nuxt 3 releases, and `@nuxt/nitro-server` `<4.6.2`.\n\n## Patches\n\nFixed in `nuxt@4.6.2`. Nuxt 3 reached end of life on 31 July 2026 and will not receive a fix.\n\nNuxt now resolves server-side route rules itself, decoding and case-folding both the rule keys and the request path unless `router.options.sensitive` is set, and applies the result to Nitro's `redirect`, `headers` and `proxy` handling, the renderer, and the `getRouteRules` / `matchRouteRules` helpers.\n\nWhen routing is case-insensitive, patched releases change some behaviour:\n\n- Route rules also apply to case variants of server API routes. For example, `/API/x` now matches a `/api/**` `proxy` or `headers` rule.\n- Rule keys that differ only in letter case now resolve to the same path on the server, and the later key takes precedence.\n\nThe following are not changed by this fix:\n\n- `cache` and `swr` response caching is attached to server routes by Nitro's router, which matches case-sensitively. A case variant is still rendered with its route rules applied, but its response is not cached.\n- Rules that a deployment preset compiles into platform configuration (for example Vercel's `config.json` or Netlify's `_redirects` and `_headers`) are matched by the platform. Once a request reaches the Nuxt server, the rules are applied as described above.\n- If `sensitive` is set only in `app/router.options.ts`, the server follows the `nuxt.config` value. In that configuration route rules can only apply to more paths, never fewer.\n\n## Workarounds\n\nUpgrade to `nuxt@4.6.2`. If you cannot upgrade, including on Nuxt 3:\n\n1. Set `router: { options: { sensitive: true } }` in `nuxt.config`, so pages are only served for the exact case of their route.\n2. Alternatively, enforce access control in server middleware or route middleware rather than relying on a `redirect` route rule, and set security headers for every response rather than per route.","summary":"Nuxt skips server-side route rules (redirect, headers, proxy, ssr) when the request path differs from a rule key only in letter case, while the page router still serves the page. An attacker can request a case variant such as /Admin/secret to bypass a redirect to /login or drop per-route security headers.","severity":"medium","cvss":6.3,"epss":0.0031399999279528856,"exploited":false,"exploited_at":null,"products":[{"name":"nuxt","fixed":["4.6.2"],"affected":">= 4.0.0, < 4.6.2","ecosystem":"npm"},{"name":"nuxt","fixed":[],"affected":">= 3.0.0, < 4.0.0","ecosystem":"npm"},{"name":"@nuxt/nitro-server","fixed":["4.6.2"],"affected":">= 4.2.0, < 4.6.2","ecosystem":"npm"},{"name":"@nuxt/nitro-server","fixed":[],"affected":">= 3.20.0, < 4.0.0","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["cwe-178","cwe-863","nitro","nuxt","nuxt-3","package","self-hosted"],"not_affected_if":["access-checks-in-middleware","managed-hosting","no-route-rules-on-protected-paths","router.options.sensitive-true"],"how_to_check":"Check nuxt and @nuxt/nitro-server versions in package.json or lockfile; check nuxt.config for router.options.sensitive; check routeRules for redirect, headers or proxy on paths that need protection.","fix":"Upgrade nuxt to 4.6.2 (Nuxt 3 has no fix, as it reached end of life). If you cannot upgrade, set router.options.sensitive: true in nuxt.config, or enforce access control in server or route middleware instead of route rules.","status":"open","published_at":"2026-10-21T18:17:26+00:00","first_seen_at":"2026-10-23T19:11:31+00:00","triaged_at":"2026-10-23T20:06:34+00:00","updated_at":"2026-10-23T21:57:29+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-10-23T20:06:34Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade nuxt to 4.6.2 (Nuxt 3 has no fix, as it reached end of life). If you cannot upgrade, set router.options.sensitive: true in nuxt.config, or enforce access control in server or route middleware instead of route rules.","summary":"Nuxt skips server-side route rules (redirect, headers, proxy, ssr) when the request path differs from a rule key only in letter case, while the page router still serves the page. An attacker can request a case variant such as /Admin/secret to bypass a redirect to /login or drop per-route security headers.","category":"package","who_cares":["nuxt","nuxt-3","self-hosted","nitro"],"confidence":0.85,"analyst_note":"","how_to_check":"Check nuxt and @nuxt/nitro-server versions in package.json or lockfile; check nuxt.config for router.options.sensitive; check routeRules for redirect, headers or proxy on paths that need protection.","needs_analyst":false,"not_affected_if":["router.options.sensitive-true","no-route-rules-on-protected-paths","access-checks-in-middleware","managed-hosting"],"severity_if_unknown":"medium"},"cost_usd":0.000563,"input_tokens":3595,"output_tokens":406,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-114132':26A,34A '-178':40B '-2026':25A,33A '-3':46B '-863':42B '/admin':122C,128C,228C,314C '/admin/secret':92B,320C,325C '/api':498C '/api/x':494C '/login':98B,230C,316C,323C '/nuxt/nuxt/security/advisories/ghsa-hxvh-4h3w-prp9))':190C '/nuxt/nuxt/security/advisories/ghsa-mm7m-92g8-7m47),':182C '1':648C '2':668C '2026':418C '3':399C,410C,647C '31':416C '4.6.2':395C,403C,408C,639C '4h3w':186C '4x84':30A '7m47':179C '92g8':178C 'access':353C,671C 'advisori':207C 'affect':339C,373C,377C,392C 'also':483C 'altern':669C 'api':490C 'app':200C 'app/pages/admin/secret.vue':327C 'app/router.options.ts':615C 'appli':172C,211C,452C,484C,563C,605C,629C 'applic':330C 'appmiddlewar':205C 'attach':361C,540C 'attack':84B 'auto':293C 'auto-import':292C 'away':222C 'behaviour':480C 'bypass':94B 'cach':534C,538C,569C 'cannot':642C 'case':15A,22A,74B,88B,119C,148C,162C,192C,307C,349C,437C,474C,486C,510C,551C,554C,664C 'case-fold':191C,436C 'case-insensit':21A,118C,473C 'case-sensit':147C,550C 'case-vari':14A 'chang':478C,530C 'check':354C 'compil':575C 'config.json':583C 'configur':319C,578C,624C 'content':257C 'content-security-polici':256C 'control':672C 'cover':208C 'cve':24A,32A 'cwe':39B,41B 'data':241C,369C 'decod':434C 'default':109C,311C 'definenuxtconfig':312C 'definepagemeta':363C 'deploy':573C 'describ':607C 'despit':287C 'differ':66B,154C,506C 'drop':100B 'earlier':173C 'end':412C 'enforc':670C 'event':291C 'everi':692C 'exact':348C,663C 'exampl':493C,580C 'export':310C 'factor':329C 'fals':111C,275C 'fetch':240C,370C 'fewer':634C 'fix':174C,405C,424C,533C 'fold':193C,438C 'follow':527C,618C 'frame':263C 'getrouterul':290C,467C 'ghsa':28A,176C,184C 'ghsa-hxvh-4h3w-prp9':183C 'ghsa-mm7m-92g8-7m47':175C 'ghsa-vjh5-4x84-xrqp':27A 'github.com':181C,189C 'github.com/nuxt/nuxt/security/advisories/ghsa-hxvh-4h3w-prp9))':188C 'github.com/nuxt/nuxt/security/advisories/ghsa-mm7m-92g8-7m47),':180C 'handl':462C 'header':8A,59B,105B,245C,250C,253C,459C,501C,589C,690C 'helper':469C 'host':50B 'howev':132C 'hxvh':185C 'impact':106C 'import':294C 'includ':251C,396C,644C 'insensit':23A,120C,475C 'instead':244C 'issu':375C 'juli':417C 'key':70B,146C,158C,442C,504C,523C 'later':522C 'letter':73B,161C,509C 'life':414C 'match':145C,388C,496C,549C,591C 'matcher':143C 'matchrouterul':299C,468C 'middlewar':358C,360C,675C,678C 'mitig':328C 'mm7m':177C 'netlifi':585C 'never':633C 'nitro':43B,138C,456C,545C 'none':168C 'noscript':277C 'nuxt':1A,35A,36A,44B,45B,51B,112C,199C,394C,398C,407C,409C,425C,600C,638C,646C 'nuxt.config':336C,620C,655C 'nuxt/nitro-server':37A,38A,402C 'nuxt/server':297C,301C 'option':264C,651C 'packag':47B 'page':77B,82B,114C,126C,166C,225C,235C,279C,342C,367C,657C 'patch':404C,476C 'path':17A,65B,153C,391C,446C,516C,632C 'per':102B,247C,696C 'per-rout':101B,246C 'perform':355C 'platform':577C,594C 'polici':259C 'preced':525C 'preset':574C 'protect':378C 'proxi':9A,60B,268C,273C,461C,499C 'prp9':187C 'rather':679C,694C 'reach':411C,598C 'read':202C 'receiv':422C 'redirect':7A,58B,96B,215C,229C,315C,321C,458C,587C,684C 'releas':400C,477C 'reli':380C,681C 'render':123C,164C,243C,283C,326C,464C,558C 'request':64B,86B,151C,270C,390C,445C,597C 'resolv':116C,136C,427C,512C 'respons':249C,537C,566C,693C 'result':454C 'return':302C 'rout':5A,19A,56B,103B,117C,133C,141C,195C,248C,352C,359C,386C,431C,471C,481C,491C,543C,561C,625C,667C,677C,685C,697C 'route-rul':140C 'router':78B,115C,547C,650C 'router.options.sensitive':110C,333C,448C 'routerul':313C 'rule':6A,57B,69B,134C,142C,157C,171C,196C,210C,217C,289C,304C,387C,432C,441C,482C,502C,503C,562C,570C,603C,626C,686C 'script':286C 'secur':104B,252C,258C,689C 'self':49B 'self-host':48B 'send':220C 'sensit':149C,552C,610C,652C 'sent':267C 'serv':80B,345C,660C 'server':3A,54B,131C,214C,239C,282C,357C,384C,429C,489C,519C,542C,601C,617C,674C 'server-fetch':238C 'server-rend':281C 'server-sid':2A,53B,383C,428C 'set':332C,450C,612C,649C,688C 'ship':285C 'side':4A,55B,385C,430C 'skip':12A,52B,232C 'ssr':10A,61B,274C 'still':79B,557C 'swr':536C 'take':524C 'therefor':163C 'true':334C,653C 'ts':309C 'unless':447C 'upgrad':636C,643C 'use':218C 'valu':621C 'variant':16A,89B,308C,487C,555C 'vercel':581C 'version':393C 'visitor':221C 'vjh5':29A 'whose':152C 'workaround':635C 'x':262C 'x-frame-opt':261C 'xrqp':31A","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T18:17:26+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-vjh5-4x84-xrqp","url":"https://github.com/advisories/GHSA-vjh5-4x84-xrqp","severity":"medium","published_at":"2026-10-22T16:59:55+00:00","modified_at":"2026-10-22T16:59:57+00:00","first_seen_at":"2026-10-23T19:11:31+00:00","fetched_at":"2026-10-23T19:11:31+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-114132","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114132","severity":null,"published_at":"2026-10-21T18:17:26+00:00","modified_at":"2026-10-23T15:17:25+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}