---
id: "GHSA-r99w-jh2x-3mg9"
page: "https://infrastack.ai/live/GHSA-r99w-jh2x-3mg9"
kind: "vulnerability"
aliases: ["GHSA-r99w-jh2x-3mg9"]
title: "Incomplete fix for GHSA-9v7c-q64q-vv33: a leading `//` in the request path bypasses `server/middleware` path checks and server route rules on page routes"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "@nuxt/nitro-server", "fixed": ["4.6.4"], "affected": ">= 4.6.0, < 4.6.4", "ecosystem": "npm"}]
ecosystems: ["npm"]
tags: ["auth-middleware", "cwe-436", "cwe-863", "nitro", "nuxt", "package", "self-hosted"]
not_affected_if: ["api-only", "route-rules-unused", "static-export", "version-outside-range"]
published_at: "2026-11-02T21:00:20+00:00"
first_seen_at: "2026-11-09T22:53:16+00:00"
updated_at: "2026-11-09T22:54:39+00:00"
sources: [{"source": "ghsa-repo", "url": "https://github.com/nuxt/nuxt/security/advisories/GHSA-r99w-jh2x-3mg9", "first_seen_at": "2026-11-09T22:53:16+00:00"}]
exploit_sources: []
---

# Incomplete fix for GHSA-9v7c-q64q-vv33: a leading `//` in the request path bypasses `server/middleware` path checks and server route rules on page routes

Link for people: https://infrastack.ai/live/GHSA-r99w-jh2x-3mg9 (this .md is for agents)

Nuxt 4.6.0 to 4.6.3 renders the page at /admin for a request path like //x/admin, while Nitro route rules and server middleware see the unmatched path. An unauthenticated attacker can skip server-side checks such as auth guards, redirects and security headers on page routes.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:@nuxt/nitro-server affected >= 4.6.0, < 4.6.4 fixed 4.6.4

## How to check

- Run `npm ls @nuxt/nitro-server` in the project and check whether the version is `4.6.0` to `4.6.3`.
- Look for `serverHandlers` with `middleware: true`, `redirect` or `headers` route rules, or `server/middleware` that check paths like `/admin`.

## Fix

- `@nuxt/nitro-server` `4.6.4` (nuxt `4.6.4` depends on it)
- Workaround from the advisory: reject paths starting with `//` in a server middleware, or strip repeated slashes at a reverse proxy or CDN.

## Timeline

- 2026-11-09T22:53:16+00:00 ghsa-repo https://github.com/nuxt/nuxt/security/advisories/GHSA-r99w-jh2x-3mg9

## Documents

- [advisory] Maintainer's advisory: github.com https://github.com/nuxt/nuxt/security/advisories/GHSA-r99w-jh2x-3mg9

## From the sources

### Summary

Since `4.6.0`, Nuxt parses a request path that starts with `//` as a URL with a host before rendering a page, so `//x/admin` renders the page at `/admin`. Nitro's routing, Nitro's route rules and `server/middleware` see the path as `//x/admin`, so server-side checks keyed on `/admin` do not apply. The fix for [GHSA-9v7c-q64q-vv33](https://github.com/nuxt/nuxt/security/advisories/GHSA-9v7c-q64q-vv33) in `4.6.3` covered dot segments but not this form.

### Impact

An unauthenticated attacker can bypass server-side controls that match on the request path of a page route.

A route-scoped server handler is skipped:

```ts
// nuxt.config.ts
export default defineNuxtConfig({
  serverHandlers: [{ route: '/admin', middleware: true, handler: '~~/server/admin-guard.ts' }],
})
```

```ts
// server/admin-guard.ts
export default defineEventHandler((event) => {
  if (!isAuthenticated(event)) {
    throw createError({ statusCode: 401 })
  }
})
```

With this handler, `/admin` returns 401, but `//x/admin` and `///x/admin` render `app/pages/admin.vue` along with the data it fetches during server rendering. `server/middleware` that checks `event.path.startsWith('/admin')` is skipped in the same way.

Server-side `redirect` and `headers` route rules are also skipped, so `'/admin/**': { redirect: '/login' }` does not redirect `//x/admin/secret`, and per-route security headers such as `Content-Security-Policy` are not sent.

Browsers send a path such as `//x/admin` as written, so a plain link is enough to reach the page.

Not affected:

- API handlers in `server/api` and `server/routes`, which Nitro does not match for these paths.
- `appMiddleware` route rules and middleware declared with `definePageMeta`, which are matched against the resolved route.
- Nuxt `3.x` and `4.0.0` to `4.5.x`, which pass the path to the page router unchanged, so these requests 404.

### Patches

Fixed in `@nuxt/nitro-server@4.6.4`, which `nuxt@4.6.4` depends on. The renderer now uses the request path exactly as Nitro matched it, so a path starting with `//` no longer resolves to a different page.

### Workarounds

Reject request paths that start with `//` in a server middleware:

```ts
// server/middleware/double-slash.ts
export default defineEventHandler((event) => {
  if (event.path.startsWith('//')) {
    throw createError({ statusCode: 404 })
  }
})
```

A reverse proxy or CDN that merges repeated slashes before forwarding the request also removes the mismatch.

### Credits

Thanks to @kq5y for reporting this issue.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_