Nuxt: Route rules are matched against the raw request path, so a percent-encoded segment can bypass `appMiddleware` on dynamic and catch-all routes

影響: npm:nuxt >= 4.0.0, < 4.4.4 → 4.4.4, npm:nuxt >= 3.11.0, < 3.21.4 → 3.21.4

Nuxt compared routeRules keys against the raw request path, without decoding percent-encoding, while the router decodes parameters when it resolves a route. A request whose path is percent-encoded can therefore resolve to a page while failing to match the route rule meant to protect it, so the rule's appMiddleware never runs, including during server rendering. Impact For a page served through a dynamic or catch-all route, an attacker can percent-encode a character in the path to skip the rule:…

GitHub Advisory Database에서 읽기

2026. 10. 23. 오전 01:50, GitHub Advisory Database에서 "Nuxt: Route rules are matched against the raw request path, so a percent-encoded segment can bypass `appMiddleware` on dynamic and catch-all routes"을(를) 게시했습니다 (유형: 취약점 권고). 심각도는 "보통"(medium)입니다. 관련 기술: JavaScript / Node.js, Nuxt. CVE: CVE-2026-114131.