---
id: "GHSA-r9jc-w898-3fv6"
page: "https://infrastack.ai/live/GHSA-r9jc-w898-3fv6"
kind: "vulnerability"
aliases: ["GHSA-r9jc-w898-3fv6"]
title: "Nuxt payload URL generation has quadratic cost for repeated slashes in the request path"
severity: "low"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "nuxt", "fixed": ["4.6.4"], "affected": ">= 4.6.0, < 4.6.4", "ecosystem": "npm"}]
ecosystems: ["npm"]
tags: ["cwe-1333", "node", "nuxt", "package", "self-hosted"]
not_affected_if: ["client-only", "default-config", "static-export"]
published_at: "2026-11-02T20:59:19+00:00"
first_seen_at: "2026-11-09T22:53:16+00:00"
updated_at: "2026-11-09T22:58:48+00:00"
sources: [{"source": "ghsa-repo", "url": "https://github.com/nuxt/nuxt/security/advisories/GHSA-r9jc-w898-3fv6", "first_seen_at": "2026-11-09T22:53:16+00:00"}]
exploit_sources: []
---

# Nuxt payload URL generation has quadratic cost for repeated slashes in the request path

Link for people: https://infrastack.ai/live/GHSA-r9jc-w898-3fv6 (this .md is for agents)

Nuxt 4.6.0 through 4.6.3 strips trailing slashes with a regular expression whose cost grows quadratically with long runs of slashes. A single unauthenticated request with a long run of slashes can block the server's event loop for a fraction of a second, delaying other requests in the same process.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:nuxt affected >= 4.6.0, < 4.6.4 fixed 4.6.4

## How to check

- Check the installed `nuxt` version in `package.json` and the lockfile; affected if it is `>= 4.6.0` and `< 4.6.4`.
- Look for `isr`, `swr` or `cache` entries in `routeRules`, or `experimental.early404` in `nuxt.config`; the issue needs one of these to apply.

## Fix

- `nuxt` `4.6.4`

## Timeline

- 2026-11-09T22:53:16+00:00 ghsa-repo https://github.com/nuxt/nuxt/security/advisories/GHSA-r9jc-w898-3fv6

## Documents

- [advisory] Maintainer's advisory: github.com https://github.com/nuxt/nuxt/security/advisories/GHSA-r9jc-w898-3fv6

## From the sources

### Summary

Nuxt strips trailing slashes from the request path with a regular expression whose cost grows quadratically with the length of a run of consecutive slashes. A single unauthenticated request with a long run of slashes can occupy the server's event loop for a noticeable time, delaying every other request handled by the same process.

### Impact

When a page is rendered with payload extraction (any route covered by an `isr`, `swr` or `cache` route rule), Nuxt builds the `_payload.json` URL from the raw request path. A path such as `/blog/a` followed by 16,000 slashes and `x`, which fits within Node's default header size limit, takes roughly 0.1 to 0.4 seconds of synchronous CPU time per request, depending on hardware. Concurrent requests to the same process wait for it to finish, so a modest request rate can keep a process saturated.

An app is affected if it uses Nuxt 4.6.0 or later with server-side rendering and has a route rule like:

```ts
export default defineNuxtConfig({
  routeRules: {
    '/blog/**': { swr: true },
  },
})
```

The same pattern is also reachable through the opt-in `experimental.early404` option, for any request path.

Apps without `isr`, `swr` or `cache` route rules and without `experimental.early404` are not affected, nor are fully prerendered or client-only apps. The cost is bounded by the maximum request path length, so a reverse proxy with a smaller header limit reduces it further. There is no confidentiality or integrity impact.

### Patches

Fixed in `nuxt` 4.6.4. Trailing slashes are now removed with a linear scan instead of a regular expression.

### Workarounds

Reject request paths containing repeated slashes before they reach the renderer, for example at the reverse proxy or with a server middleware:

```ts
// server/middleware/reject-repeated-slashes.ts
export default defineEventHandler((event) => {
  if (event.path.split('?')[0]!.includes('//')) {
    throw createError({ statusCode: 404 })
  }
})
```

If you use `experimental.early404`, you can also disable it until you upgrade.

### Credits

Thanks to cryptofox9 for reporting this issue.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_