Live › vulnerability › CVE-2026-120309
In Nuxt 4.6.0 before 4.6.2, getRouterParam and getRouterParams can return a route parameter value different from the one h3 matched, when the request path contains an encoded question mark (%3F). An attacker can craft a request so an authorization check sees one resource while the handler loads another, reaching resources they should not access.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 03:31 UTC. All times on this page are UTC.
Applications built with Nuxt 4.6.0 through 4.6.x before 4.6.2 that have server routes using route parameters for access checks. Sites that only serve static output or do not use these server helpers for authorization are less exposed. unknown whether other h3-based frameworks are affected.
No product ranges from the sources yet.
package.json or lockfile, e.g. npm ls nuxt; affected versions are 4.6.0 up to but not including 4.6.2.getRouterParam or getRouterParams for an authorization decision and then load a resource through event.context.params.4.6.2 or later (the sources state the fix is in 4.6.2).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Nuxt from 4.6.0 before 4.6.2 contains a route parameter confusion vulnerability in getRouterParam and getRouterParams that lets attackers return a parameter value different from the one h3 matched by sending paths containing an encoded question mark (%3F). Attackers can craft requests where authorization checks use the Nuxt helper value while resource selection uses event.context.params, allowing access to unauthorized resources.
This page as .md · .json · in your agent: get_signal("CVE-2026-120309")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.