NUXT · GHSA-r9jc-w898-3fv6 · Package
FIX → 4.6.4
Nuxt 4.6.0 through 4.6.3 strips trailing slashes with a regular expression whose cost grows quadratically with long runs of slashes. A single unauthenticated request with a long run of slashes can block the server's event loop for a fraction of a second, delaying other requests in the same process.
first public Nov 2, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Apps using Nuxt 4.6.0 or later with server-side rendering and a route rule that uses isr, swr or cache, or with experimental.early404 enabled. Prerendered apps, client-only apps, and apps without those route rules or options are not affected. The impact is limited to denial of service by slowing the process; there is no data exposure or integrity impact.
Not affected if client-only, default-config, static-export
Who cares node, nuxt, self-hosted
nuxt version in package.json and the lockfile; affected if it is >= 4.6.0 and < 4.6.4.isr, or entries in , or in ; the issue needs one of these to apply.Nuxt strips trailing slashes from the request path with a regular expression whose cost grows quadratically with the length of a run of consecutive slashes. A single unauthenticated request with a long run of slashes can occupy the server's event loop for a noticeable time, delaying every other request handled by the same process.
When a page is rendered with payload extraction (any route covered by an isr, swr or cache route rule), Nuxt builds the _payload.json URL from the raw request path. A path such as /blog/a followed by 16,000 slashes and x, which fits within Node's default header size limit, takes roughly 0.1 to 0.4 seconds of synchronous CPU time per request, depending on hardware. Concurrent requests to the same process wait for it to finish, so a modest request rate can keep a process saturated.
An app is affected if it uses Nuxt 4.6.0 or later with server-side rendering and has a route rule like:
export default defineNuxtConfig({
routeRules: {
'/blog/**': { : },
},
})
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
swrcacherouteRulesexperimental.early404nuxt.configUpgrade to 4.6.4
nuxt 4.6.4The same pattern is also reachable through the opt-in experimental.early404 option, for any request path.
Apps without isr, swr or cache route rules and without experimental.early404 are not affected, nor are fully prerendered or client-only apps. The cost is bounded by the maximum request path length, so a reverse proxy with a smaller header limit reduces it further. There is no confidentiality or integrity impact.
Fixed in nuxt 4.6.4. Trailing slashes are now removed with a linear scan instead of a regular expression.
Reject request paths containing repeated slashes before they reach the renderer, for example at the reverse proxy or with a server middleware:
// server/middleware/reject-repeated-slashes.ts
export default defineEventHandler((event) => {
if (event.path.split('?')[0]!.includes('//')) {
throw createError({ statusCode: 404 })
}
})
If you use experimental.early404, you can also disable it until you upgrade.
Thanks to cryptofox9 for reporting this issue.