CVE-2026-128071

Nuxt matches route rules against the request path with encoded slashes (%2F) left encoded, while the page router decodes them into route params. A request that spells a slash as %2F can therefore render a page through a catch-all route without the route rules configured for the path it resolves to. The fix for GHSA-6gq8-jgmh-3ffp deliberately left reserved escapes such as %2F encoded, so it did not cover this form.

An unauthenticated attacker can bypass route rules that protect paths served by a catch-all page route, or by a custom route whose param can span several segments.

With app/pages/docs/[...slug].vue, /docs/internal/guide runs auth, but /docs/internal%2Fguide renders the same page without running auth and without the header. With a root app/pages/[...slug].vue, /admin%2Fsecret is rendered instead of redirected.

The rules skipped include server-side redirect, headers, proxy, ssr and noScripts, and appMiddleware, appLayout and redirect as matched in the app during server…