CVE-2026-114131 nuxt CVE debrief

Who should care

Developers and administrators using Nuxt for web application development, particularly those using dynamic or catch-all routes with appMiddleware for authentication or authorization.

Why it matters

CVE-2026-114131 allows attackers to bypass appMiddleware on dynamic and catch-all routes in Nuxt, potentially leading to unauthorized access or actions.

• Unauthenticated access to gated pages via bypassed appMiddleware.
• Potential for unauthorized actions or data exposure.
• Need for review and update of Nuxt configurations.
• Verification of patches or updates to affected versions.

Technical summary

The Nuxt framework does not decode percent-encoding in route rules, allowing an attacker to bypass appMiddleware on dynamic and catch-all routes by percent-encoding a character in the path. This vulnerability affects pages served through dynamic or catch-all routes, potentially leading to unauthorized access or actions if not properly mitigated. The issue arises from the framework's handling of route rules against the raw request path, without decoding percent-encoding, while the router decodes parameters when resolving a route.

Defensive priority

High

Recommended defensive actions

• Review and update Nuxt configurations to ensure route rules are properly applied.
• Verify and apply patches or updates to affected Nuxt versions.
• Monitor for and respond to potential bypass attempts on dynamic and catch-all routes.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and source item provide details on a vulnerability in Nuxt where route rules are matched against the raw request path, allowing a percent-encoded segment to bypass appMiddleware on dynamic and catch-all routes.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.