CVE-2026-120309

Name of the Vulnerable Software and Affected Versions Nuxt versions 4.6.0 through 4.6.1

Description Route parameter confusion occurs in the getRouterParam() and getRouterParams() functions. By sending paths containing an encoded question mark (%3F), attackers can cause these functions to return a parameter value that differs from the one matched by h3. This discrepancy allows attackers to craft requests where authorization checks rely on the Nuxt helper value while the actual resource selection uses event.context.params, potentially granting access to unauthorized resources.

Recommendations Update Nuxt to version 4.6.2.