Nuxt: Server-side route rules (`redirect`, `headers`, `proxy`, `ssr`) are skipped for case-variant paths when routing is case-insensitive

影響: npm:nuxt >= 4.0.0, < 4.6.2 → 4.6.2, npm:nuxt >= 3.0.0, < 4.0.0, npm:@nuxt/nitro-server >= 4.2.0, < 4.6.2 → 4.6.2, npm:@nuxt/nitro-server >= 3.20.0, < 4.0.0

With the default router.options.sensitive: false, Nuxt's page router resolves routes case-insensitively, so /Admin renders the same page as /admin. On the server, however, route rules were resolved with Nitro's route-rule matcher, which matches keys case-sensitively. A request whose path differs from a rule key only in letter case therefore rendered the page with none of that rule applied. Earlier fixes ([GHSA-mm7m-92g8-7m47](https://github.com/nuxt/nuxt/security/advisories/GHSA-mm7m-92g8-7m47)…

Read on GitHub Advisory Database

On 10/23/2026, 01:59 AM, GitHub Advisory Database published "Nuxt: Server-side route rules (`redirect`, `headers`, `proxy`, `ssr`) are skipped for case-variant paths when routing is case-insensitive" (type: Advisory). Severity is "Medium" (medium). Related technologies: JavaScript / Node.js, Nuxt, GitHub. CVE: CVE-2026-114132.