UpHeron
All vulnerabilities

Servers and applications

CVE-2026-114131

Nuxt: Route rules are matched against the raw request path, so a percent-encoded segment can bypass `appMiddleware` on dynamic and catch-all routes

Severity
Medium 6.5
Published
21 Oct 2026
Last changed
30 Oct 2026
Added to UpHeron
3 Nov 2026
Fixed in
3.21.4, 4.4.4
Sources
CVE Program

Affected software

SoftwareAffected versions
NuxtServers and applications · cna:nuxt|nuxt
  • From 3.11.0 before 3.21.4
  • From 4.0.0 before 4.4.4

References

  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-114131