Live › vulnerability › CVE-2026-119200
From Nuxt 4.6.0 through 4.6.3, dot segments such as /%2e/admin are resolved for page rendering but not for server middleware, route rules, or security headers. An attacker can reach a page and its server-rendered data while checks keyed to /admin are skipped.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 21:26 UTC. All times on this page are UTC.
Applications built with Nuxt 4.6.0 through 4.6.3 that serve pages and enforce access through server middleware, route rules, or per-route security headers. API handlers and appMiddleware are not affected, and exploitation needs a client that sends dot segments without browser normalization.
No product ranges from the sources yet.
npm ls nuxt or check the nuxt version in package.json and the lockfile.4.6.3Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Nuxt is an open-source web development framework for Vue.js. From 4.6.0 until 4.6.3, Nuxt resolves literal or percent-encoded dot segments before rendering a page while Nitro routing, server/middleware checks, and server route rules evaluate the unresolved path. A request such as /%2e/admin can therefore render app/pages/admin.vue and its server-rendered data while checks keyed to /admin, redirects, or per-route security headers do not apply. API handlers, appMiddleware, Nuxt 3, and Nuxt 4.0.0 through 4.5.x are not affected, and exploitation requires a client that sends dot segments without browser normalization. This issue is fixed in version 4.6.3.
This page as .md · .json · in your agent: get_signal("CVE-2026-119200")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.