{"id":"CVE-2026-114131","aliases":[],"cve":{"records":[{"id":"CVE-2026-114131","source":"GitHub_M","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-10-20T21:53:58.473Z","published":"2026-10-21T17:41:24.016Z","modified":"2026-10-30T17:48:52.857Z"}],"publishers":[{"name":"GitHub_M","role":"CNA","organizationId":"a0819718-46f1-4df5-94e2-005712e83aaa","modified":"2026-10-21T17:41:24.016Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-10-30T17:48:52.857Z"}],"references":[{"url":"https://github.com/nuxt/nuxt/security/advisories/GHSA-6gq8-jgmh-3ffp","tags":["x_refsource_CONFIRM"],"source":"GitHub_M"},{"url":"https://github.com/nuxt/nuxt/commit/81f86ac5ee82bb1a9b887e59f3bc84624d711497","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/nuxt/nuxt/commit/9123ed850c468a7424a868c20d0d49a5507d32e5","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/nuxt/nuxt/releases/tag/v3.21.11","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/nuxt/nuxt/releases/tag/v4.5.2","tags":["x_refsource_MISC"],"source":"GitHub_M"}],"weaknesses":[{"id":"CWE-436","description":"CWE-436: Interpretation Conflict","source":"GitHub_M"},{"id":"CWE-863","description":"CWE-863: Incorrect Authorization","source":"GitHub_M"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-10-30T17:48:43.512590Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"yes"},{"name":"Technical Impact","value":"partial"}]}]},"title":"Nuxt: Route rules are matched against the raw request path, so a percent-encoded segment can bypass `appMiddleware` on dynamic and catch-all routes","titleSource":"GitHub_M","descriptionSource":"GitHub_M","description":"Nuxt is an open-source web development framework for Vue.js. From 3.11.0 until 3.21.4 and 4.4.4, Nuxt compares route-rule keys with the raw request path while route resolution decodes dynamic and catch-all parameters, allowing a percent-encoded segment to resolve to a protected page without matching the routeRules entry intended for that path. As a result, appMiddleware can be skipped during server rendering and an unauthenticated requester can receive the gated page and its SSR data. The same mismatch affects app-manifest rules including redirect, appLayout, ssr, prerender, and payload flags derived from cache, isr, and swr. This vulnerability is fixed in 4.4.4 and 3.21.4.","score":6.5,"severity":"medium","published":"2026-10-21T17:41:24.016Z","modified":"2026-10-30T17:48:52.857Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"nuxt","name":"nuxt","platforms":[],"versions":[{"version":">= 4.0.0, < 4.4.4","status":"affected"},{"version":">= 3.11.0, < 3.21.4","status":"affected"}],"cpes":[],"source":"GitHub_M","url":"https://www.cve.org/CVERecord?id=CVE-2026-114131"}],"remediation":[],"references":["https://github.com/nuxt/nuxt/security/advisories/GHSA-6gq8-jgmh-3ffp","https://github.com/nuxt/nuxt/commit/81f86ac5ee82bb1a9b887e59f3bc84624d711497","https://github.com/nuxt/nuxt/commit/9123ed850c468a7424a868c20d0d49a5507d32e5","https://github.com/nuxt/nuxt/releases/tag/v3.21.11","https://github.com/nuxt/nuxt/releases/tag/v4.5.2"],"sources":[{"name":"CVE","id":"CVE-2026-114131","modified":"2026-10-30T17:48:52.857Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-114131"}],"assessments":[{"source":"GitHub_M","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","score":6.5}],"sourceAffected":[],"observedAt":"2026-10-30T18:28:06.159Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T10:20:31.211Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-10-30T18:40:32.774Z","attemptedAt":"2026-10-30T18:40:32.774Z"},{"source":"GHSA","status":"available","checkedAt":"2026-10-30T18:40:32.936Z","attemptedAt":"2026-10-30T18:40:32.936Z"},{"source":"EUVD","status":"available","checkedAt":"2026-10-30T18:40:32.504Z","attemptedAt":"2026-10-30T18:40:32.504Z"},{"source":"EPSS","status":"available","checkedAt":"2026-10-30T18:40:32.968Z","attemptedAt":"2026-10-30T18:40:32.968Z"}],"evidence":[{"source":"ENISA EUVD","id":"EUVD-2026-107414","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-107414","modified":"Oct 21, 2026, 5:41:24 PM","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","checkedAt":"2026-10-30T18:40:32.504Z"},{"source":"NVD","id":"CVE-2026-114131","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114131","modified":"2026-10-30T18:17:22.087","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","checkedAt":"2026-10-30T18:40:32.774Z"},{"source":"GitHub Advisory Database","id":"GHSA-6gq8-jgmh-3ffp","url":"https://github.com/advisories/GHSA-6gq8-jgmh-3ffp","modified":"2026-10-22T16:50:54Z","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","checkedAt":"2026-10-30T18:40:32.936Z"},{"source":"FIRST EPSS","id":"CVE-2026-114131","url":"https://www.first.org/epss/","probability":0.00363,"percentile":0.30128,"date":"2026-10-30","checkedAt":"2026-10-30T18:40:32.968Z"}],"aiSummary":null}