{"id":"CVE-2026-119200","aliases":["EUVD-2026-113371","GHSA-9v7c-q64q-vv33"],"status":"published","title":"Nuxt: Dot segments in the request path bypass `server/middleware` path checks and server route rules on page routes","description":"Nuxt is an open-source web development framework for Vue.js. From 4.6.0 until 4.6.3, Nuxt resolves literal or percent-encoded dot segments before rendering a page while Nitro routing, server/middleware checks, and server route rules evaluate the unresolved path. A request such as /%2e/admin can therefore render app/pages/admin.vue and its server-rendered data while checks keyed to /admin, redirects, or per-route security headers do not apply. API handlers, appMiddleware, Nuxt 3, and Nuxt 4.0.0 through 4.5.x are not affected, and exploitation requires a client that sends dot segments without browser normalization. This issue is fixed in version 4.6.3.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00339,"percentile":0.27652,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-41","CWE-436","CWE-863"],"published":"2026-10-29T20:17:08Z","modified":"2026-11-05T02:30:53Z","exploits":[{"source":"pocgithub","id":"federiconbaez/cortex9-nuxt-dot-segment-middleware-bypass-model","title":"federiconbaez/cortex9-nuxt-dot-segment-middleware-bypass-model","date":"2026-11-09","url":"https://github.com/federiconbaez/cortex9-nuxt-dot-segment-middleware-bypass-model"}],"fixes":[{"ecosystem":"npm","package":"nuxt","fixed_in":["4.6.3"],"sources":["ghsa","osv"]},{"ecosystem":"npm","package":"@nuxt/nitro-server","fixed_in":["4.6.3"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"nuxt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.6.0"},{"fixed":"4.6.3"}]}]},{"source":"ghsa","ecosystem":"npm","package":"@nuxt/nitro-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.6.0"},{"fixed":"4.6.3"}]}]},{"source":"osv","ecosystem":"npm","package":"nuxt","ranges":[{"type":"SEMVER","events":[{"introduced":"4.6.0"},{"fixed":"4.6.3"}]}]},{"source":"osv","ecosystem":"npm","package":"@nuxt/nitro-server","ranges":[{"type":"SEMVER","events":[{"introduced":"4.6.0"},{"fixed":"4.6.3"}]}]}],"products":[{"vendor":"@clerk","product":"nuxt"},{"vendor":"@nuxt","product":"nitro-server"},{"vendor":"nuxt","product":"nuxt"}],"references":[{"url":"https://github.com/nuxt/nuxt/security/advisories/GHSA-9v7c-q64q-vv33","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/nuxt/nuxt/commit/45463f8b58487e387149ebfb704d6a0834b3a450","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/nuxt/nuxt/releases/tag/v4.6.3","tags":["x_refsource_MISC","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119200","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-9v7c-q64q-vv33"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/119xxx/CVE-2026-119200.json","tags":["advisory"]},{"url":"https://github.com/nuxt/nuxt","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-119200","title":"Nuxt: Dot segments in the request path bypass `server/middleware` path checks and server route rules on page routes","description":"Nuxt is an open-source web development framework for Vue.js. From 4.6.0 until 4.6.3, Nuxt resolves literal or percent-encoded dot segments before rendering a page while Nitro routing, server/middleware checks, and server route rules evaluate the unresolved path. A request such as /%2e/admin can therefore render app/pages/admin.vue and its server-rendered data while checks keyed to /admin, redirects, or per-route security headers do not apply. API handlers, appMiddleware, Nuxt 3, and Nuxt 4.0.0 through 4.5.x are not affected, and exploitation requires a client that sends dot segments without browser normalization. This issue is fixed in version 4.6.3.","status":"published","published":"2026-10-29T20:17:08.837Z","modified":"2026-11-04T01:41:26.806Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-41","CWE-436","CWE-863"],"updated_at":"2026-11-04T02:49:29.029968Z"}],"euvd":[{"id":"EUVD-2026-113371","description":"Nuxt is an open-source web development framework for Vue.js. From 4.6.0 until 4.6.3, Nuxt resolves literal or percent-encoded dot segments before rendering a page while Nitro routing, server/middleware checks, and server route rules evaluate the unresolved path. A request such as /%2e/admin can therefore render app/pages/admin.vue and its server-rendered data while checks keyed to /admin, redirects, or per-route security headers do not apply. API handlers, appMiddleware, Nuxt 3, and Nuxt 4.0.0 through 4.5.x are not affected, and exploitation requires a client that sends dot segments without browser normalization. This issue is fixed in version 4.6.3.","status":"published","published":"2026-10-29T20:17:08Z","modified":"2026-11-04T01:41:26Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-04T03:57:29.097782Z"}],"ghsa":[{"id":"GHSA-9v7c-q64q-vv33","title":"Nuxt: Dot segments in the request path bypass `server/middleware` path checks and server route rules on page routes","description":"### Summary\n\nSince `4.6.0`, Nuxt resolves `.` and `..` segments in the request path, including percent-encoded forms such as `%2e`, before rendering a page. Nitro's routing, Nitro's route rules and `server/middleware` see the path with those segments still in place. A request for `/%2e/admin` therefore renders the page at `/admin`, while server-side checks keyed on `/admin` do not apply.\n\n### Impact\n\nAn unauthenticated attacker can bypass server-side controls that match on the request path of a page route.\n\n`server/middleware` that checks `event.path` (or `event.node.req.url`) is skipped:\n\n```ts\nexport default defineEventHandler((event) =\u003e {\n  if (event.path.startsWith('/admin') \u0026\u0026 !isAuthenticated(event)) {\n    throw createError({ statusCode: 401 })\n  }\n})\n```\n\nWith this middleware, `/admin` returns 401, but `/%2e/admin`, `/.%2e/admin` and `/x/%2e%2e/admin` reach the middleware with `event.path` set to `/./admin`, `/../admin` and `/x/../admin`, and render `app/pages/admin.vue` along with the data it fetches during server rendering.\n\nServer-side `redirect` and `headers` route rules are skipped in the same way, so `'/admin/**': { redirect: '/login' }` does not redirect `/%2e/admin/secret`, and per-route security headers such as `Content-Security-Policy` are not sent.\n\nNot affected:\n\n- API handlers in `server/api` and `server/routes`. Nitro's router does not resolve dot segments, so these requests do not reach the handler.\n- `appMiddleware` route rules and middleware declared with `definePageMeta`, which are matched against the resolved route.\n- Nuxt `3.x` and `4.0.0` to `4.5.x`, which pass the path to the page router unchanged, so these requests 404.\n\nBrowsers resolve dot segments before sending a request, so exploitation requires a client that sends the path as written.\n\n### Patches\n\nFixed in `nuxt@4.6.3` and `@nuxt/nitro-server@4.6.3`. A page request whose path contains `.` or `..` segments now receives a 404 instead of rendering the page the path resolves to, and route-rule keys and lookup paths have their dot segments resolved, including percent-encoded spellings, before they are compared.\n\n### Workarounds\n\nReject dot segments in a server middleware that runs before your other middleware (middleware runs in file name order):\n\n```ts\n// server/middleware/0.dot-segments.ts\nexport default defineEventHandler((event) =\u003e {\n  if (/(?:^|\\/)\\.{1,2}(?:\\/|$)/.test(event.path.split('?')[0])) {\n    throw createError({ statusCode: 404 })\n  }\n})\n```\n\nChecking `getRequestURL(event).pathname` instead of `event.path` is not a sufficient workaround: it resolves dot segments, but keeps percent-encoding such as `%61` that the page router decodes. Path checks in server middleware should also account for the page router matching paths case-insensitively unless `router.options.sensitive` is set.\n\nA reverse proxy or CDN that normalises the request path before forwarding it also removes the mismatch.\n\n### Credits\n\nThanks to @vinzabe, @nikhilagrawalsf (Nikhil Agrawal, Mettle Labs), @0xjunwei and @kq5y, who reported this issue independently.","status":"published","published":"2026-10-30T23:00:53Z","modified":"2026-10-30T23:00:54Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-41","CWE-436","CWE-863"],"updated_at":"2026-11-02T14:41:41.028239Z"}],"nvd":[{"id":"CVE-2026-119200","description":"Nuxt is an open-source web development framework for Vue.js. From 4.6.0 until 4.6.3, Nuxt resolves literal or percent-encoded dot segments before rendering a page while Nitro routing, server/middleware checks, and server route rules evaluate the unresolved path. A request such as /%2e/admin can therefore render app/pages/admin.vue and its server-rendered data while checks keyed to /admin, redirects, or per-route security headers do not apply. API handlers, appMiddleware, Nuxt 3, and Nuxt 4.0.0 through 4.5.x are not affected, and exploitation requires a client that sends dot segments without browser normalization. This issue is fixed in version 4.6.3.","status":"published","published":"2026-10-29T21:17:18.943Z","modified":"2026-11-04T02:17:18.313Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-41","CWE-436","CWE-863"],"updated_at":"2026-11-04T06:53:34.694679Z"}],"osv":[{"id":"CVE-2026-119200","title":"Nuxt: Dot segments in the request path bypass `server/middleware` path checks and server route rules on page routes","description":"Nuxt is an open-source web development framework for Vue.js. From 4.6.0 until 4.6.3, Nuxt resolves literal or percent-encoded dot segments before rendering a page while Nitro routing, server/middleware checks, and server route rules evaluate the unresolved path. A request such as /%2e/admin can therefore render app/pages/admin.vue and its server-rendered data while checks keyed to /admin, redirects, or per-route security headers do not apply. API handlers, appMiddleware, Nuxt 3, and Nuxt 4.0.0 through 4.5.x are not affected, and exploitation requires a client that sends dot segments without browser normalization. This issue is fixed in version 4.6.3.","status":"published","published":"2026-10-29T20:17:08.837Z","modified":"2026-11-05T02:30:53.527893554Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-41","CWE-436","CWE-863"],"updated_at":"2026-11-07T03:08:01.41647Z"},{"id":"GHSA-9v7c-q64q-vv33","title":"Nuxt: Dot segments in the request path bypass `server/middleware` path checks and server route rules on page routes","description":"### Summary\n\nSince `4.6.0`, Nuxt resolves `.` and `..` segments in the request path, including percent-encoded forms such as `%2e`, before rendering a page. Nitro's routing, Nitro's route rules and `server/middleware` see the path with those segments still in place. A request for `/%2e/admin` therefore renders the page at `/admin`, while server-side checks keyed on `/admin` do not apply.\n\n### Impact\n\nAn unauthenticated attacker can bypass server-side controls that match on the request path of a page route.\n\n`server/middleware` that checks `event.path` (or `event.node.req.url`) is skipped:\n\n```ts\nexport default defineEventHandler((event) =\u003e {\n  if (event.path.startsWith('/admin') \u0026\u0026 !isAuthenticated(event)) {\n    throw createError({ statusCode: 401 })\n  }\n})\n```\n\nWith this middleware, `/admin` returns 401, but `/%2e/admin`, `/.%2e/admin` and `/x/%2e%2e/admin` reach the middleware with `event.path` set to `/./admin`, `/../admin` and `/x/../admin`, and render `app/pages/admin.vue` along with the data it fetches during server rendering.\n\nServer-side `redirect` and `headers` route rules are skipped in the same way, so `'/admin/**': { redirect: '/login' }` does not redirect `/%2e/admin/secret`, and per-route security headers such as `Content-Security-Policy` are not sent.\n\nNot affected:\n\n- API handlers in `server/api` and `server/routes`. Nitro's router does not resolve dot segments, so these requests do not reach the handler.\n- `appMiddleware` route rules and middleware declared with `definePageMeta`, which are matched against the resolved route.\n- Nuxt `3.x` and `4.0.0` to `4.5.x`, which pass the path to the page router unchanged, so these requests 404.\n\nBrowsers resolve dot segments before sending a request, so exploitation requires a client that sends the path as written.\n\n### Patches\n\nFixed in `nuxt@4.6.3` and `@nuxt/nitro-server@4.6.3`. A page request whose path contains `.` or `..` segments now receives a 404 instead of rendering the page the path resolves to, and route-rule keys and lookup paths have their dot segments resolved, including percent-encoded spellings, before they are compared.\n\n### Workarounds\n\nReject dot segments in a server middleware that runs before your other middleware (middleware runs in file name order):\n\n```ts\n// server/middleware/0.dot-segments.ts\nexport default defineEventHandler((event) =\u003e {\n  if (/(?:^|\\/)\\.{1,2}(?:\\/|$)/.test(event.path.split('?')[0])) {\n    throw createError({ statusCode: 404 })\n  }\n})\n```\n\nChecking `getRequestURL(event).pathname` instead of `event.path` is not a sufficient workaround: it resolves dot segments, but keeps percent-encoding such as `%61` that the page router decodes. Path checks in server middleware should also account for the page router matching paths case-insensitively unless `router.options.sensitive` is set.\n\nA reverse proxy or CDN that normalises the request path before forwarding it also removes the mismatch.\n\n### Credits\n\nThanks to @vinzabe, @nikhilagrawalsf (Nikhil Agrawal, Mettle Labs), @0xjunwei and @kq5y, who reported this issue independently.","status":"published","published":"2026-10-30T23:00:53Z","modified":"2026-10-30T23:15:07.324895962Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-41","CWE-436","CWE-863"],"updated_at":"2026-11-02T15:46:44.225359Z"}]}}