https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 26 Oct 2026 10:52:09 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-114131 <p>Nuxt is an open-source web development framework for Vue.js. From 3.11.0 until 3.21.4 and 4.4.4, Nuxt compares route-rule keys with the raw request path while route resolution decodes dynamic and catch-all parameters, allowing a percent-encoded segment to resolve to a protected page without matching the routeRules entry intended for that path. As a result, appMiddleware can be skipped during server rendering and an unauthenticated requester can receive the gated page and its SSR data. The same mismatch affects app-manifest rules including redirect, appLayout, ssr, prerender, and payload flags derived from cache, isr, and swr. This vulnerability is fixed in 4.4.4 and 3.21.4.</p> <p>Nuxt is an open-source web development framework for Vue.js. From 3.11.0 until 3.21.4 and 4.4.4, Nuxt compares route-rule keys with the raw request path while route resolution decodes dynamic and catch-all parameters, allowing a percent-encoded segment to resolve to a protected page without matching the routeRules entry intended for that path. As a result, appMiddleware can be skipped during server rendering and an unauthenticated requester can receive the gated page and its SSR data. The same mismatch affects app-manifest rules including redirect, appLayout, ssr, prerender, and payload flags derived from cache, isr, and swr. This vulnerability is fixed in 4.4.4 and 3.21.4.</p> https://db.gcve.eu/vuln/fkie_cve-2026-114131 https://db.gcve.eu/vuln/ghsa-6gq8-jgmh-3ffp <p><strong>Affected:</strong> npm: nuxt</p> <p>### Summary</p> <p>Nuxt compared `routeRules` keys against the raw request path, without decoding percent-encoding, while the router decodes parameters when it resolves a route. A request whose path is percent-encoded can therefore resolve to a page while failing to match the route rule meant to protect it, so the rule&#39;s `appMiddleware` never runs, including during server rendering.</p> <p>### Impact</p> <p>For a page served through a dynamic or catch-all route, an attacker can percent-encode a character in the path to skip the rule:</p> <p>```ts export default defineNuxtConfig({ routeRules: { &#39;/users/admin&#39;: { appMiddleware: &#39;auth&#39; }, }, }) ```</p> <p>Requesting `/users/%61dmin` still renders `app/pages/users/[id].vue` with `id` decoded to `admin`, but the rule keyed `/users/admin` does not match, so `auth` does not run and the server renders and returns the gated page to an unauthenticated visitor. No privileges and no user interaction are required, and only ASCII characters are involved.</p> <p>Purely static ASCII routes are not affected: static segments are matched without decoding, so a request for `/%61dmin` does not resolve to the page registered at `/admin` and 404s instead of rendering.</p> <p>The rule keys affected are the ones carried in the app manifest and consumed by the app: `appMiddleware`, `redirect`, `appLayout`, `ssr`, `prerender`, and the payload flags derived from `cache`, `isr` and `swr`.</p> <p>If you have pinned or overridden dependency versions below what your Nuxt release declares, a rele…</p> <p><strong>Affected:</strong> npm: nuxt</p> <p>### Summary</p> <p>Nuxt compared `routeRules` keys against the raw request path, without decoding percent-encoding, while the router decodes parameters when it resolves a route. A request whose path is percent-encoded can therefore resolve to a page while failing to match the route rule meant to protect it, so the rule&#39;s `appMiddleware` never runs, including during server rendering.</p> <p>### Impact</p> <p>For a page served through a dynamic or catch-all route, an attacker can percent-encode a character in the path to skip the rule:</p> <p>```ts export default defineNuxtConfig({ routeRules: { &#39;/users/admin&#39;: { appMiddleware: &#39;auth&#39; }, }, }) ```</p> <p>Requesting `/users/%61dmin` still renders `app/pages/users/[id].vue` with `id` decoded to `admin`, but the rule keyed `/users/admin` does not match, so `auth` does not run and the server renders and returns the gated page to an unauthenticated visitor. No privileges and no user interaction are required, and only ASCII characters are involved.</p> <p>Purely static ASCII routes are not affected: static segments are matched without decoding, so a request for `/%61dmin` does not resolve to the page registered at `/admin` and 404s instead of rendering.</p> <p>The rule keys affected are the ones carried in the app manifest and consumed by the app: `appMiddleware`, `redirect`, `appLayout`, `ssr`, `prerender`, and the payload flags derived from `cache`, `isr` and `swr`.</p> <p>If you have pinned or overridden dependency versions below what your Nuxt release declares, a rele…</p> https://db.gcve.eu/vuln/ghsa-6gq8-jgmh-3ffp