{"id":"EUVD-2026-107414","enisaUuid":"9da15678-8adc-32a5-a7ed-b6901d8aada3","description":"Nuxt is an open-source web development framework for Vue.js. From 3.11.0 until 3.21.4 and 4.4.4, Nuxt compares route-rule keys with the raw request path while route resolution decodes dynamic and catch-all parameters, allowing a percent-encoded segment to resolve to a protected page without matching the routeRules entry intended for that path. As a result, appMiddleware can be skipped during server rendering and an unauthenticated requester can receive the gated page and its SSR data. The same mismatch affects app-manifest rules including redirect, appLayout, ssr, prerender, and payload flags derived from cache, isr, and swr. This vulnerability is fixed in 4.4.4 and 3.21.4.","datePublished":"Oct 21, 2026, 5:41:24 PM","dateUpdated":"Oct 30, 2026, 5:48:52 PM","baseScore":6.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","references":"https://github.com/nuxt/nuxt/security/advisories/GHSA-6gq8-jgmh-3ffp\nhttps://github.com/nuxt/nuxt/commit/81f86ac5ee82bb1a9b887e59f3bc84624d711497\nhttps://github.com/nuxt/nuxt/commit/9123ed850c468a7424a868c20d0d49a5507d32e5\nhttps://github.com/nuxt/nuxt/releases/tag/v3.21.11\nhttps://github.com/nuxt/nuxt/releases/tag/v4.5.2\n","aliases":"CVE-2026-114131\nGHSA-6gq8-jgmh-3ffp\n","assigner":"GitHub_M","epss":0.36,"enisaIdProduct":[{"id":"3ee774fb-e93f-357b-9b65-49f7d71a229e","product":{"name":"nuxt","vendor":{"name":"@clerk"}},"product_version":"4.0.0, \u003c 4.4.4"},{"id":"7a712415-74ec-3410-984b-40010589129d","product":{"name":"nuxt","vendor":{"name":"@clerk"}},"product_version":"3.11.0, \u003c 3.21.4"}],"enisaIdVendor":[{"id":"0d83dafd-6c62-315c-83d0-28db2532141a","vendor":{"name":"nuxt"}}],"enisaIdVulnerability":[{"id":"3ea5185a-8a2a-3f1e-8e21-961dcb3b94f5","vulnerability":{"id":"CVE-2026-114131","description":"Nuxt is an open-source web development framework for Vue.js. From 3.11.0 until 3.21.4 and 4.4.4, Nuxt compares route-rule keys with the raw request path while route resolution decodes dynamic and catch-all parameters, allowing a percent-encoded segment to resolve to a protected page without matching the routeRules entry intended for that path. As a result, appMiddleware can be skipped during server rendering and an unauthenticated requester can receive the gated page and its SSR data. The same mismatch affects app-manifest rules including redirect, appLayout, ssr, prerender, and payload flags derived from cache, isr, and swr. This vulnerability is fixed in 4.4.4 and 3.21.4.","datePublished":"Oct 21, 2026, 5:41:24 PM","dateUpdated":"Oct 30, 2026, 5:48:52 PM","status":"PUBLISHED","baseScore":6.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","references":"https://github.com/nuxt/nuxt/security/advisories/GHSA-6gq8-jgmh-3ffp\nhttps://github.com/nuxt/nuxt/commit/81f86ac5ee82bb1a9b887e59f3bc84624d711497\nhttps://github.com/nuxt/nuxt/commit/9123ed850c468a7424a868c20d0d49a5507d32e5\nhttps://github.com/nuxt/nuxt/releases/tag/v3.21.11\nhttps://github.com/nuxt/nuxt/releases/tag/v4.5.2\n","enisa_id":"EUVD-2026-107414\n","assigner":"GitHub_M","epss":0.36,"dataProcessed":"Nov 1, 2026, 4:11:18 AM","vulnerabilityProduct":[{"id":"272775cd-4ca6-383c-991a-b9fc9394593d","product":{"name":"nuxt","vendor":{"name":"@clerk"}},"product_version":"3.11.0, \u003c 3.21.4"},{"id":"5d314b2f-4ad3-32e1-8403-b7340ef2694a","product":{"name":"nuxt","vendor":{"name":"@clerk"}},"product_version":"4.0.0, \u003c 4.4.4"}],"vulnerabilityVendor":[{"id":"0c3915d2-ed4f-3811-8c94-dab6f92341ce","vendor":{"name":"nuxt"}}]}},{"id":"564c6deb-f865-35d8-8d7d-bbb6239dea15","vulnerability":{"id":"GHSA-6gq8-jgmh-3ffp","description":"Nuxt: Route rules are matched against the raw request path, so a percent-encoded segment can bypass `appMiddleware` on dynamic and catch-all routes","datePublished":"Oct 22, 2026, 4:50:53 PM","dateUpdated":"Oct 22, 2026, 4:50:53 PM","baseScore":0.0,"references":"https://github.com/nuxt/nuxt/security/advisories/GHSA-6gq8-jgmh-3ffp\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-114131\nhttps://github.com/nuxt/nuxt/commit/81f86ac5ee82bb1a9b887e59f3bc84624d711497\nhttps://github.com/nuxt/nuxt/commit/9123ed850c468a7424a868c20d0d49a5507d32e5\nhttps://github.com/nuxt/nuxt\nhttps://github.com/nuxt/nuxt/releases/tag/v3.21.11\nhttps://github.com/nuxt/nuxt/releases/tag/v4.5.2\n","enisa_id":"EUVD-2026-107414\n","aliases":"GHSA-6gq8-jgmh-3ffp\nCVE-2026-114131\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:09:03 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}