https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-26T13:37:21.689135+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-114131 CVE-2026-114131 — Nuxt: Route rules are matched against the raw request path, so a percent-encoded segment can bypass `appMiddleware` on… 2026-10-26T13:37:21.690486+00:00

Affected: nuxt

Nuxt is an open-source web development framework for Vue.js. From 3.11.0 until 3.21.4 and 4.4.4, Nuxt compares route-rule keys with the raw request path while route resolution decodes dynamic and catch-all parameters, allowing a percent-encoded segment to resolve to a protected page without matching the routeRules entry intended for that path. As a result, appMiddleware can be skipped during server rendering and an unauthenticated requester can receive the gated page and its SSR data. The same mismatch affects app-manifest rules including redirect, appLayout, ssr, prerender, and payload flags derived from cache, isr, and swr. This vulnerability is fixed in 4.4.4 and 3.21.4.