UpHeron
All vulnerabilities

Servers and applications

CVE-2026-128077

Incomplete fix for GHSA-9v7c-q64q-vv33: a leading `//` in the request path bypasses `server/middleware` path checks and server route rules on page routes

Severity
Medium 6.5
Published
2 Nov 2026
Last changed
13 Nov 2026
Added to UpHeron
13 Nov 2026
Fixed in
4.6.4
Weakness
CWE-436Incorrect authorization (CWE-863)
Attack
Over the network · No login needed · No user action needed
Attacker can
Read some data · Change some data
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Also known as
GHSA-r99w-jh2x-3mg9
Sources
CVE Program, Project advisories (GitHub)

Description

Since 4.6.0, Nuxt parses a request path that starts with // as a URL with a host before rendering a page, so //x/admin renders the page at /admin. Nitro's routing, Nitro's route rules and server/middleware see the path as //x/admin, so server-side checks keyed on /admin do not apply. The fix for GHSA-9v7c-q64q-vv33 in 4.6.3 covered dot segments but not this form.

An unauthenticated attacker can bypass server-side controls that match on the request path of a page route.

A route-scoped server handler is skipped:

With this handler, /admin returns 401, but //x/admin and ///x/admin render app/pages/admin.vue along with the data it fetches during server rendering. server/middleware that checks event.path.startsWith('/admin') is skipped in the same way.

Server-side redirect and headers route rules are also skipped, so '/admin/**': { redirect: '/login' } does not redirect //x/admin/secret, and per-route security headers such as Content-Security-Policy are not sent.

From nuxt/nuxt's security advisory. Shortened; the full text is there.

Workarounds

Reject request paths that start with // in a server middleware:

A reverse proxy or CDN that merges repeated slashes before forwarding the request also removes the mismatch.

Workarounds as given by nuxt/nuxt's security advisory.

Affected software

SoftwareAffected versions
NuxtServers and applications · cna:nuxt|nuxt
  • From 4.6.0 before 4.6.4
NuxtServers and applications · github:nuxt/nuxt
  • From 4.6.0 before 4.6.4

References