---
id: "GHSA-p4h3-4h99-9665"
page: "https://infrastack.ai/live/GHSA-p4h3-4h99-9665"
kind: "vulnerability"
aliases: ["GHSA-p4h3-4h99-9665"]
title: "Nuxt Vite server builder wildcard `redirect` route rules can redirect to another origin"
severity: "low"
cvss: 3.1
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "@nuxt/vite-server", "fixed": ["4.6.4"], "affected": ">= 4.6.0, < 4.6.4", "ecosystem": "npm"}]
ecosystems: ["npm"]
tags: ["cwe-601", "nuxt", "package", "self-hosted", "vite"]
not_affected_if: ["nitro-server-builder", "no-wildcard-redirect", "spa-build", "static-export"]
published_at: "2026-11-02T20:59:42+00:00"
first_seen_at: "2026-11-09T22:53:16+00:00"
updated_at: "2026-11-09T22:58:22+00:00"
sources: [{"source": "ghsa-repo", "url": "https://github.com/nuxt/nuxt/security/advisories/GHSA-p4h3-4h99-9665", "first_seen_at": "2026-11-09T22:53:16+00:00"}]
exploit_sources: []
---

# Nuxt Vite server builder wildcard `redirect` route rules can redirect to another origin

Link for people: https://infrastack.ai/live/GHSA-p4h3-4h99-9665 (this .md is for agents)

A wildcard redirect route rule in the experimental Vite server builder can turn a crafted request path into a protocol-relative Location header. A visitor following a link to the site can be sent to an origin an attacker chooses.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:@nuxt/vite-server affected >= 4.6.0, < 4.6.4 fixed 4.6.4

## How to check

- Check that `nuxt` or `@nuxt/vite-server` resolves to a version at or above `4.6.4` in the lockfile.
- Look in `nuxt.config` for `server: { builder: 'vite' }` and for `routeRules` entries with a `redirect` target starting with `**` or `/**`.

## Fix

- `@nuxt/vite-server` `4.6.4` (fixed version; `nuxt` `4.6.4` depends on it)
- Workaround stated by the source: give wildcard redirect targets a path before the `**` (for example `'/new/**'`), or build with the default Nitro server builder.

## Timeline

- 2026-11-09T22:53:16+00:00 ghsa-repo https://github.com/nuxt/nuxt/security/advisories/GHSA-p4h3-4h99-9665

## Documents

- [advisory] Maintainer's advisory: github.com https://github.com/nuxt/nuxt/security/advisories/GHSA-p4h3-4h99-9665

## From the sources

### Summary

Under the experimental Vite server builder (`@nuxt/vite-server`), a wildcard `redirect` route rule whose target starts with `**` or `/**` could redirect to another origin. A request path continuing with an extra `/` or `\` after the rule's prefix (or a path that normalises to one, such as `/old/x/..//evil.example`) produced a protocol-relative `Location` header.

### Impact

A wildcard `redirect` rule copies the rest of the request path onto its target. With this configuration:

```ts
export default defineNuxtConfig({
  server: { builder: 'vite' },
  routeRules: {
    '/old/**': { redirect: '/**' },
  },
})
```

the server built by `nuxt build` (`.output/server/index.mjs`) redirected a request for `/old//evil.example` or `/old/\evil.example` to `//evil.example`, which browsers follow to `evil.example`. A link to an affected site can therefore send a visitor to an origin chosen by an attacker.

Only applications that meet all of the following are affected:

- They build with the experimental Vite server builder (`server: { builder: 'vite' }`), which was introduced in `4.6.0`. Applications on the default Nitro server builder (`@nuxt/nitro-server`) do not run this code.
- They deploy its server output. Static output (`nuxt generate`) and SPA builds (`ssr: false`) have no server and are not affected.
- They have a wildcard `redirect` rule whose target starts with `**` or `/**`, such as `'/**'` or `'/**/x'`. Targets with a path before the `**` (`'/new/**'`) stay on the same origin.

Nuxt 3 does not include the Vite server builder.

### Patches

Fixed in `@nuxt/vite-server` 4.6.4, which `nuxt` 4.6.4 depends on. A run of separators (`/`, `\` or their percent-encoded forms) at the start of the copied path now collapses to a single `/`, so the target stays on the origin it names.

### Workarounds

Upgrade to `nuxt` 4.6.4. If you cannot upgrade, give wildcard redirect targets a path before the `**` (for example `'/new/**'`), or build with the default Nitro server builder.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_