CVE-2026-114132

Name of the Vulnerable Software and Affected Versions Nuxt versions prior to 4.6.2

Description Nuxt resolves pages case-insensitively by default, whereas Nitro matches server-side route-rule keys case-sensitively. This discrepancy allows requests with paths that differ only by letter case to render without applying the intended server rules. Consequently, this can bypass redirects, headers, proxy settings, ssr: false, and noScripts configurations. Additionally, the functions getRouteRules(event) and matchRouteRules() may return no rule for the case variant. Access checks in server middleware, page route middleware, or page data fetching are not affected by this issue.

Recommendations Update to version 4.6.2. Set router.options.sensitive: true in nuxt.config to prevent case-insensitive page resolution.