Nuxt is an open-source web development framework for Vue.js. From 4.6.0 until 4.6.3, Nuxt resolves literal or percent-encoded dot segments before rendering a page while Nitro routing, server/middleware checks, and server route rules evaluate the unresolved path. A request such as /%2e/admin can therefore render app/pages/admin.vue and its server-rendered data while checks keyed to /admin, redirects, or per-route security headers do not apply. API handlers, appMiddleware, Nuxt 3, and Nuxt 4.0.0 through 4.5.x are not affected, and exploitation requires a client that sends dot segments without browser normalization. This issue is fixed in version 4.6.3.
Fix
Nothing published yet: no patch, vendor advisory or mitigation reference on NVD, no vendor advisory in the News for this CVE, not in CISA's KEV, no fixed package version. BaselineWatch does not guess at one.
Change history 1
- First seenCVSS 6.5 · nuxt, @nuxtNVD modified 2026-10-29 20:17
Affected (CPE criteria) 0
NVD has not attached CPE configurations yet.
References 3
- https://github.com/nuxt/nuxt/security/advisories/GHSA-9v7c-q64q-vv33 x_refsource_confirm
- https://github.com/nuxt/nuxt/commit/45463f8b58487e387149ebfb704d6a0834b3a450 x_refsource_misc
- https://github.com/nuxt/nuxt/releases/tag/v4.6.3 x_refsource_misc