---
id: "GHSA-w7gw-66vg-99gq"
page: "https://infrastack.ai/live/GHSA-w7gw-66vg-99gq"
kind: "vulnerability"
aliases: ["GHSA-w7gw-66vg-99gq"]
title: "`getRouterParam` from `nuxt/server` can return a different param from the one h3 matched when the path contains `%3F`"
severity: "low"
cvss: 3.7
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "nuxt", "note": ">= 4.6.0 < 4.6.2", "fixed": ["4.6.2"], "affected": "", "ecosystem": "npm"}, {"name": "@nuxt/nitro-server", "note": ">= 4.6.0 < 4.6.2", "fixed": ["4.6.2"], "affected": "", "ecosystem": "npm"}]
ecosystems: ["npm"]
tags: ["cwe-436", "cwe-863", "h3", "nitro", "nuxt", "package", "server-routes"]
not_affected_if: ["below-4.6.0", "no-route-param-auth-check", "nuxt-3", "single-param-source"]
published_at: "2026-10-16T18:58:57+00:00"
first_seen_at: "2026-11-09T22:53:16+00:00"
updated_at: "2026-11-09T22:57:28+00:00"
sources: [{"source": "ghsa-repo", "url": "https://github.com/nuxt/nuxt/security/advisories/GHSA-w7gw-66vg-99gq", "first_seen_at": "2026-11-09T22:53:16+00:00"}]
exploit_sources: []
---

# `getRouterParam` from `nuxt/server` can return a different param from the one h3 matched when the path contains `%3F`

Link for people: https://infrastack.ai/live/GHSA-w7gw-66vg-99gq (this .md is for agents)

The getRouterParam and getRouterParams helpers in nuxt/server can return a different path segment than the one h3 matched when a request path contains an encoded question mark (%3F). An application that checks authorization with one param source and looks up a resource with another can pass the check for one resource and act on a different one.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:nuxt affected range not listed fixed 4.6.2
- npm:@nuxt/nitro-server affected range not listed fixed 4.6.2

## How to check

- Check the installed versions with `npm ls nuxt @nuxt/nitro-server`; affected if they are `>=4.6.0 <4.6.2`.
- Search server routes for `getRouterParam` or `getRouterParams` used alongside `event.context.params` or another source for the same param, especially in authorization checks.
- Note that Nuxt 3 and releases before `4.6.0` are not affected.

## Fix

- nuxt `4.6.2`
- @nuxt/nitro-server `4.6.2`

## Timeline

- 2026-11-09T22:53:16+00:00 ghsa-repo https://github.com/nuxt/nuxt/security/advisories/GHSA-w7gw-66vg-99gq

## Documents

- [advisory] Vendor advisory: github.com https://github.com/nuxt/nuxt/security/advisories/GHSA-w7gw-66vg-99gq

## From the sources

## Impact

`getRouterParam` and `getRouterParams` from `nuxt/server` return the route params that h3 matched, with their original percent-encoding preserved. To do so, they line up the raw request URL with the decoded path h3 routed on.

When a path segment contained an encoded question mark (`%3F`), h3 routed on the decoded path only up to that `?`, but the raw URL was not cut at the same point. The helpers then read params from the wrong segments, so they could return a different value from the one h3 matched in `event.context.params`. Named (`[id]`), unnamed and catch-all (`[...slug]`) params are affected.

For example, with `server/api/auth/[...slug].get.ts`, a request to `/api/auth/private%3Fignored/public` is matched by h3 with `slug` set to `private`, while `getRouterParam(event, 'slug', { decode: true })` returned `public`.

An application is affected if it uses the Nuxt helper for one decision (such as an authorization check) and h3's matched params, or another source, for another (such as selecting the resource). In that case a request can pass the check for one resource and act on another.

## Mitigating factors

- Exploitation requires an application that reads the same route param from two different sources and relies on them agreeing. Applications that read params only through `getRouterParam(s)` from `nuxt/server`, or only through `event.context.params` / h3's helpers, are not affected.
- The helpers were introduced in `4.6.0`. Earlier releases and Nuxt 3 are not affected.

## Affected versions

`nuxt` and `@nuxt/nitro-server` `>=4.6.0 <4.6.2`.

## Patches

Fixed in `nuxt@4.6.2`. The helpers now rebuild params from exactly the path h3 routed on, and check that each value decodes to the param h3 matched. If any value does not, they return h3's params unchanged, so they can only return a different encoding of h3's match, never a different value.

## Workarounds

Upgrade to `nuxt@4.6.2`. If you cannot upgrade:

1. Read a route param from a single source for both the check and the lookup.
2. Alternatively, reject requests whose path contains `%3F` in a server middleware.

## References

- [Server imports documentation](https://nuxt.com/docs/4.x/guide/going-further/server-imports)

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_