{"id":"CVE-2026-120309","kind":"vulnerability","aliases":["CVE-2026-120309"],"related":[],"title":"Nuxt: encoded question mark in path lets requests read the wrong route parameter","description":"Nuxt from 4.6.0 before 4.6.2 contains a route parameter confusion vulnerability in getRouterParam and getRouterParams that lets attackers return a parameter value different from the one h3 matched by sending paths containing an encoded question mark (%3F). Attackers can craft requests where authorization checks use the Nuxt helper value while resource selection uses event.context.params, allowing access to unauthorized resources.","summary":"In Nuxt 4.6.0 before 4.6.2, getRouterParam and getRouterParams can return a route parameter value different from the one h3 matched, when the request path contains an encoded question mark (%3F). An attacker can craft a request so an authorization check sees one resource while the handler loads another, reaching resources they should not access.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["h3","node","nuxt","runtime","self-hosted"],"not_affected_if":["no-server-routes","static-export","version-below-4.6.0"],"how_to_check":"- Check the Nuxt version in the project's `package.json` or lockfile, e.g. `npm ls nuxt`; affected versions are `4.6.0` up to but not including `4.6.2`.\n- Look for server routes that use `getRouterParam` or `getRouterParams` for an authorization decision and then load a resource through `event.context.params`.","fix":"- Nuxt: move to `4.6.2` or later (the sources state the fix is in 4.6.2).","status":"open","published_at":"2026-11-02T03:17:28+00:00","first_seen_at":"2026-11-02T03:31:21+00:00","triaged_at":"2026-11-02T03:31:55+00:00","updated_at":"2026-11-02T03:31:55+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-02T03:31:55Z","model":"claude-haiku-5-5","output":{"fix":"- Nuxt: move to `4.6.2` or later (the sources state the fix is in 4.6.2).","reach":"internet","title":"Nuxt: encoded question mark in path lets requests read the wrong route parameter","impact":"medium","summary":"In Nuxt 4.6.0 before 4.6.2, getRouterParam and getRouterParams can return a route parameter value different from the one h3 matched, when the request path contains an encoded question mark (%3F). An attacker can craft a request so an authorization check sees one resource while the handler loads another, reaching resources they should not access.","audience":"developers","category":"runtime","nicknames":[],"who_cares":["nuxt","h3","self-hosted","node"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"attacker reads unauthorized resources through mismatched route parameter","analyst_note":"Confirm exact exploit conditions and whether other h3 consumers are affected; check the Nuxt 4.6.2 release notes and the NVD entry for CVSS details.","how_to_check":"- Check the Nuxt version in the project's `package.json` or lockfile, e.g. `npm ls nuxt`; affected versions are `4.6.0` up to but not including `4.6.2`.\n- Look for server routes that use `getRouterParam` or `getRouterParams` for an authorization decision and then load a resource through `event.context.params`.","plain_action":"","needs_analyst":true,"not_affected_if":["static-export","no-server-routes","version-below-4.6.0"],"who_is_affected":"Applications built with Nuxt 4.6.0 through 4.6.x before 4.6.2 that have server routes using route parameters for access checks. Sites that only serve static output or do not use these server helpers for authorization are less exposed. unknown whether other h3-based frameworks are affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000756,"input_tokens":4174,"output_tokens":677,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-120309':16A,19A '-2026':15A,18A '3f':56B,117C '4.6.0':29B,83C '4.6.2':31B,85C 'access':80B,136C 'allow':135C 'anoth':74B 'attack':58B,98C,118C 'author':65B,123C 'check':66B,124C 'confus':90C 'contain':51B,86C,112C 'craft':60B,120C 'cve':14A,17A 'differ':41B,103C 'encod':2A,53B,114C 'event.context.params':134C 'getrouterparam':32B,34B,93C,95C 'h3':20B,45B,107C 'handler':72B 'helper':128C 'host':26B 'let':7A,97C 'load':73B 'mark':4A,55B,116C 'match':46B,108C 'node':21B 'nuxt':1A,22B,28B,81C,127C 'one':44B,68B,106C 'paramet':13A,39B,89C,101C 'path':6A,50B,111C 'question':3A,54B,115C 'reach':75B 'read':9A 'request':8A,49B,62B,121C 'resourc':69B,76B,131C,139C 'return':36B,99C 'rout':12A,38B,88C 'runtim':23B 'see':67B 'select':132C 'self':25B 'self-host':24B 'send':110C 'unauthor':138C 'use':125C,133C 'valu':40B,102C,129C 'vulner':91C 'wrong':11A","nicknames":[],"mitigations":[],"who_affected":"Applications built with Nuxt 4.6.0 through 4.6.x before 4.6.2 that have server routes using route parameters for access checks. Sites that only serve static output or do not use these server helpers for authorization are less exposed. unknown whether other h3-based frameworks are affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["h3","medium","node","nuxt","runtime","selfhosted"],"first_public_at":"2026-11-02T03:17:28+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120309","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120309","severity":null,"published_at":"2026-11-02T03:17:28+00:00","modified_at":"2026-11-02T03:17:28+00:00","first_seen_at":"2026-11-02T03:31:21+00:00","fetched_at":"2026-11-02T03:31:21+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}