https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 24 Oct 2026 18:34:52 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-114132 <p>Nuxt is an open-source web development framework for Vue.js. Prior to 4.6.2, Nuxt resolves pages case-insensitively by default while Nitro matches server-side route-rule keys case-sensitively, allowing a request whose path differs only by letter case to render without the server rule intended for that page. The mismatch can skip redirect, headers, proxy, ssr: false, and noScripts, and can cause getRouteRules(event) and matchRouteRules to return no rule for the case variant. Applications that set router.options.sensitive: true in nuxt.config are not affected; setting sensitive only in app/router.options.ts does not establish this exclusion because the server follows the nuxt.config value. Access checks implemented in server middleware, page route middleware, or page data fetching remain independent of this matcher. This issue is fixed in version 4.6.2.</p> <p>Nuxt is an open-source web development framework for Vue.js. Prior to 4.6.2, Nuxt resolves pages case-insensitively by default while Nitro matches server-side route-rule keys case-sensitively, allowing a request whose path differs only by letter case to render without the server rule intended for that page. The mismatch can skip redirect, headers, proxy, ssr: false, and noScripts, and can cause getRouteRules(event) and matchRouteRules to return no rule for the case variant. Applications that set router.options.sensitive: true in nuxt.config are not affected; setting sensitive only in app/router.options.ts does not establish this exclusion because the server follows the nuxt.config value. Access checks implemented in server middleware, page route middleware, or page data fetching remain independent of this matcher. This issue is fixed in version 4.6.2.</p> https://db.gcve.eu/vuln/fkie_cve-2026-114132 https://db.gcve.eu/vuln/ghsa-vjh5-4x84-xrqp <p><strong>Affected:</strong> npm: nuxt, npm: @nuxt/nitro-server</p> <p>## Impact</p> <p>With the default `router.options.sensitive: false`, Nuxt&#39;s page router resolves routes case-insensitively, so `/Admin` renders the same page as `/admin`. On the server, however, route rules were resolved with Nitro&#39;s route-rule matcher, which matches keys case-sensitively. A request whose path differs from a rule key only in letter case therefore rendered the page with none of that rule applied.</p> <p>Earlier fixes ([GHSA-mm7m-92g8-7m47](https://github.com/nuxt/nuxt/security/advisories/GHSA-mm7m-92g8-7m47), [GHSA-hxvh-4h3w-prp9](https://github.com/nuxt/nuxt/security/advisories/GHSA-hxvh-4h3w-prp9)) case-folded the route rules that the Nuxt app itself reads, such as `appMiddleware`. This advisory covers the rules applied on the server:</p> <p>- `redirect`: a rule used to send visitors away from a page, such as `&#39;/admin/**&#39;: { redirect: &#39;/login&#39; }`, was skipped, and the page and its server-fetched data were rendered instead. - `headers`: per-route response headers, including security headers such as `Content-Security-Policy` or `X-Frame-Options`, were not sent. - `proxy`: the request was not proxied. - `ssr: false` and `noScripts`: the page was server-rendered, or shipped scripts, despite the rule. - `getRouteRules(event)` (auto-imported, or from `nuxt/server`) and `matchRouteRules` from `nuxt/server` returned no rules for the case variant.</p> <p>```ts export default defineNuxtConfig({ routeRules: { &#39;/admin/**&#39;: { redirect: &#39;/login&#39; }, }, }) ```</p> <p>With this configuration, `/…</p> <p><strong>Affected:</strong> npm: nuxt, npm: @nuxt/nitro-server</p> <p>## Impact</p> <p>With the default `router.options.sensitive: false`, Nuxt&#39;s page router resolves routes case-insensitively, so `/Admin` renders the same page as `/admin`. On the server, however, route rules were resolved with Nitro&#39;s route-rule matcher, which matches keys case-sensitively. A request whose path differs from a rule key only in letter case therefore rendered the page with none of that rule applied.</p> <p>Earlier fixes ([GHSA-mm7m-92g8-7m47](https://github.com/nuxt/nuxt/security/advisories/GHSA-mm7m-92g8-7m47), [GHSA-hxvh-4h3w-prp9](https://github.com/nuxt/nuxt/security/advisories/GHSA-hxvh-4h3w-prp9)) case-folded the route rules that the Nuxt app itself reads, such as `appMiddleware`. This advisory covers the rules applied on the server:</p> <p>- `redirect`: a rule used to send visitors away from a page, such as `&#39;/admin/**&#39;: { redirect: &#39;/login&#39; }`, was skipped, and the page and its server-fetched data were rendered instead. - `headers`: per-route response headers, including security headers such as `Content-Security-Policy` or `X-Frame-Options`, were not sent. - `proxy`: the request was not proxied. - `ssr: false` and `noScripts`: the page was server-rendered, or shipped scripts, despite the rule. - `getRouteRules(event)` (auto-imported, or from `nuxt/server`) and `matchRouteRules` from `nuxt/server` returned no rules for the case variant.</p> <p>```ts export default defineNuxtConfig({ routeRules: { &#39;/admin/**&#39;: { redirect: &#39;/login&#39; }, }, }) ```</p> <p>With this configuration, `/…</p> https://db.gcve.eu/vuln/ghsa-vjh5-4x84-xrqp