CVE-2026-114131: Nuxt Route Rules appMiddleware Bypass via Percent-Encoded Route Segments

Nuxt is an open-source web development framework built on top of Vue.js, facilitating server-side rendering (SSR), static site generation, and route-based server configurations. The framework allows developers to define routeRules in nuxt.config.ts or page metadata. These rules configure server behaviors such as appMiddleware, redirect, appLayout, ssr, and caching strategies for specific endpoint patterns.

An interpretation conflict exists between Nuxt's routeRules lookup engine and its core page router. Affected versions compare incoming requests against configured routeRules using the raw, percent-encoded URI string. Conversely, the underlying Vue page router decodes route parameters prior to executing route matching and rendering page handlers.

When an HTTP request contains percent-encoded characters in path segments, the routeRules engine fails to match the unencoded rule keys registered in the application configuration. Consequently, attached middleware—such as authentication or authorization checks—is skipped, while the page router successfully decodes the path and renders the protected resource payload.

The vulnerability stems from inconsistent URL path normalization across different architectural layers of the framework. Route rules declared in the application configuration or page metadata are indexed into a compiled matcher instance in unencoded UTF-8 format (for example, /route-rules/admin or /route-rules/测试).

When an incoming HTTP request is processed, the runtime lookup generated in #build/route-rules.mjs evaluated the raw, raw-encoded path argument (path). If an attacker sends a request using percent-encoding—such as /route-rules/%61dmin or /route-rules/%E6%B5%8B%E8%AF%95—the literal string comparison inside the lookup matcher fails to identify the entry.

Because the lookup returns an empty rule set, security controls such as appMiddleware guards are omitted. Immediately following this lookup, the Nuxt core page router processes the request, unescapes the path parameters, matches the target file-system page component, and executes server-side rendering without enforcing the intended route rules.

To resolve this issue, Nuxt implemented path normalization functions (decodeRoutePath and normalizeRouteRulePath) that decode percent-encoded sequences prior to route rule indexing and runtime matching.

The remediation introduces decodeRoutePath in packages/nuxt/src/core/utils/index.ts to decode non-reserved characters while preserving query parameters and avoiding double-decoding risks:

export function decodeRoutePath (path: string) {
  if (!path.includes('%')) { return path }
  const queryIndex = path.indexOf('?')
  const pathname = queryIndex === -1 ? path : path.slice(0, queryIndex)
  try {
    return queryIndex === -1 ? decodeURI(pathname) : decodeURI(pathname) + path.slice(queryIndex)
  } catch {
    return path
  }
}

The helper normalizeRouteRulePath in packages/nuxt/src/core/utils/route-rules.ts handles case-folding and unescaping uniform keys:

export function normalizeRouteRulePath (path: string, fold: boolean): string {
  const decoded = decodeRoutePath(path)
  return fold ? decoded.toLowerCase() : decoded
}

In addition, the server generator in packages/nitro-server/src/index.ts was updated to inject string normalization into the runtime lookup function, ensuring raw request strings are normalized before rule querying.

Exploitation requires no authentication or specialized tooling. An attacker targets an endpoint protected by a route rule configured with appMiddleware (for example, a route rule protecting /admin with an auth middleware guard).

Instead of requesting GET /admin, the attacker encodes one or more characters within the path string, submitting GET /%61dmin or GET /admi%6e. The request arrives at the server where the unpatched routeRules matcher compares /%61dmin against /admin. The matcher fails to locate a matching rule key, evaluating the rule set to empty.

The request is then passed to the page router. The router decodes /%61dmin to /admin, resolves the corresponding page component (pages/admin.vue), and executes server-side rendering. The resulting SSR HTML output and inline data payload are returned to the unauthenticated requester, bypassing the authorization check entirely.

The CVSS v3.1 score for this vulnerability is 6.5 (Medium). The primary impact is a partial loss of confidentiality and integrity due to unauthorized access to gated SSR page content and state payloads.

Because the route rule bypass affects auxiliary flags—such as redirect, appLayout, ssr, prerender, and caching behaviors—applications relying on global route rules for security enforcement or conditional page delivery are vulnerable to data leakage.

This vulnerability does not directly grant arbitrary code execution or write permissions on the underlying server filesystem. However, sensitive information rendered in SSR payloads (such as user profile data, administrative UI layouts, or internal API responses) can be accessed by unauthorized entities.

To remediate CVE-2026-114131, organizations should upgrade nuxt to version 3.21.4 (or patch release v3.21.11 / v4.5.2) for 3.x deployments, or 4.4.4 for 4.x deployments.

If immediate framework updates are not possible, reverse proxies or Web Application Firewalls (WAF) should be configured to normalize percent-encoded path sequences prior to forwarding HTTP requests to the upstream Nuxt server.

As a defense-in-depth practice, critical authorization logic should be implemented directly within individual page component guards, server middleware (server/middleware/), or API route handlers (server/api/), rather than relying solely on global routeRules configuration entries.