{"id":"ghsa-ghsa-6gq8-jgmh-3ffp","seq":309552,"kind":"advisory","title":"Nuxt: Route rules are matched against the raw request path, so a percent-encoded segment can bypass `appMiddleware` on dynamic and catch-all routes","url":"https://github.com/advisories/GHSA-6gq8-jgmh-3ffp","permalink":"https://vulnpulse.app/items/ghsa-ghsa-6gq8-jgmh-3ffp","summary":"影響: npm:nuxt >= 4.0.0, < 4.4.4 → 4.4.4, npm:nuxt >= 3.11.0, < 3.21.4 → 3.21.4\nNuxt compared routeRules keys against the raw request path, without decoding percent-encoding, while the router decodes parameters when it resolves a route. A request whose path is percent-encoded can therefore resolve to a page while failing to match the route rule meant to protect it, so the rule's appMiddleware never runs, including during server rendering. Impact For a page served through a dynamic or catch-all route, an attacker can percent-encode a character in the path to skip the rule:…","severity":"medium","techs":["nodejs","nuxt"],"cves":["CVE-2026-114131"],"tags":["GHSA-6gq8-jgmh-3ffp","nuxt","nuxt"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-22T16:50:53.000Z","fetched_at":"2026-10-22T20:09:55.169Z"}