CVE-2026-120309 nuxt CVE debrief

Who should care

Defenders responsible for Nuxt applications, specifically those using versions 4.6.0 to 4.6.1, should assess exposure and prioritize upgrading to 4.6.2 or later. This includes reviewing current deployments, identifying potential vulnerabilities, and implementing necessary security measures to prevent exploitation. Additionally, security teams should verify and adjust authorization checks and resource selection to prevent unauthorized access.

Why it matters

CVE-2026-120309 is a route parameter confusion vulnerability in Nuxt versions 4.6.0 to 4.6.1. Defenders should prioritize verifying exposure, upgrading to 4.6.2 or later, and adjusting authorization checks and resource selection. Evidence is limited to CVE and NVD records.

• Potential unauthorized resource access due to parameter confusion
• Need to verify and upgrade Nuxt versions to prevent exploitation
• Possible impact on authorization checks and resource selection

Technical summary

The vulnerability exists in the getRouterParam and getRouterParams functions in Nuxt versions from 4.6.0 before 4.6.2. An attacker can send a path containing an encoded question mark (%3F) to return a parameter value different from the one h3 matched. This allows an attacker to access unauthorized resources as the authorization checks use the Nuxt helper value while resource selection uses event.context.params.

Defensive priority

Defenders should prioritize verifying and upgrading to Nuxt version 4.6.2 or later if using affected versions.

Recommended defensive actions

• Verify Nuxt version and upgrade to 4.6.2 or later if necessary
• Review and adjust authorization checks and resource selection in Nuxt applications
• Monitor for potential unauthorized resource access attempts
• Perform vulnerability scanning to identify exposed Nuxt applications
• Review and update incident response plans for potential unauthorized resource access
• Implement additional logging and monitoring for Nuxt applications
• Conduct a thorough risk assessment to identify potential impacts on the organization

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. However, the corpus does not establish versions beyond 4.6.0 to 4.6.2, exploitation, impact, or remediation beyond upgrading to 4.6.2 or later.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.