CVE-2026-119200

Name of the Vulnerable Software and Affected Versions Nuxt versions 4.6.0 through 4.6.2

Description Nuxt resolves literal or percent-encoded dot segments before rendering a page, whereas Nitro routing, server/middleware checks, and server route rules evaluate the unresolved path. This discrepancy allows a request using dot segments, such as /%2e/admin, to render app/pages/admin.vue and its server-rendered data, bypassing security headers, redirects, or checks specifically keyed to /admin. Exploitation requires a client capable of sending dot segments without browser normalization.

Recommendations Update to version 4.6.3.