CVE-2026-128077: Authorization Bypass via Request Path Desynchronization in Nuxt and @nuxt/nitro-server

Nuxt is an open-source full-stack web application framework built on Vue.js and the Nitro server engine. Within the Nuxt architecture, incoming HTTP requests are first processed by the Nitro server layer (powered by H3), which executes server middleware, evaluates route rules (such as redirects and custom headers), and dispatches API routes. Requests that do not match static assets or explicit API routes fall through to the Nuxt server-side rendering (SSR) engine, which resolves the corresponding Vue page component from the app/pages/ directory.

CVE-2026-128077 (also tracked as GHSA-r99w-jh2x-3mg9) is an interpretation conflict (CWE-436) and incorrect authorization (CWE-863) vulnerability introduced in Nuxt 4.6.0 and @nuxt/nitro-server 4.6.0. The flaw stems from an incomplete fix for an earlier path normalization vulnerability (CVE-2026-119200 / GHSA-9v7c-q64q-vv33) patched in version 4.6.3, which addressed dot-segment traversal in page routes but did not account for scheme-relative URL authority parsing triggered by leading double slashes.

When a client submits a request whose path begins with two or more forward slashes (such as //x/admin or ///x/admin), the Nitro server layer and the Nuxt page renderer disagree on the effective pathname. Nitro middleware and routing logic inspect the literal string //x/admin, whereas the Nuxt SSR renderer constructs a standard WHATWG URL object that consumes //x as the host component and extracts /admin as the target pathname.

As a result of this path desynchronization, server-side security controls keyed to specific path prefixes—including server/middleware checks, route-scoped serverHandlers, and routeRules redirects or security headers—fail to match the incoming request. The request then reaches the Nuxt page renderer, which resolves /admin and executes the server-side rendering lifecycle for app/pages/admin.vue, returning restricted page markup and serialized server-fetched data to the unauthenticated caller.

The root cause of CVE-2026-128077 lies in how @nuxt/nitro-server adapts an incoming H3 event (H3Event) into a web-standard Request and URL representation for the Nuxt SSR renderer. In Nuxt 4.6.0, the helper function toWebView in packages/nitro-server/src/runtime/utils/event.ts was designed to construct a URL instance by passing the encoded event path directly as the first argument to the standard JavaScript URL constructor alongside a base origin string.

Specifically, the vulnerable implementation executed new URL(encodeEventPath(event.path), baseOrigin). According to the WHATWG URL Standard, when the input string provided to new URL(input, base) begins with two forward slashes (//) and does not include an explicit scheme, the state machine transitions into the scheme-relative special authority state. Everything immediately following // up to the next / (or ?, #, or end of string) is parsed as the network host (authority), overriding the host defined in the base URL parameter.

When an attacker supplies //x/admin as the request target, encodeEventPath(event.path) preserves the leading slashes and passes //x/admin to new URL('//x/admin', 'http://localhost:3000'). The WHATWG parser sets url.protocol to http:, url.host to x, and url.pathname to /admin. If the request path is ///x/admin, the WHATWG parser similarly ignores excess leading slashes in the authority state, treating x as the host and /admin as the pathname.

Because the Nuxt SSR renderer subsequently reads url.pathname to determine which Vue route to render, it sees /admin and renders app/pages/admin.vue. Conversely, all upstream Nitro components (server/middleware, serverHandlers, and routeRules) operate directly on event.path (//x/admin) without applying WHATWG authority extraction. Any access control logic that checks whether event.path starts with /admin evaluates to false, creating a split-brain routing state between the security enforcement layer and the rendering layer.

The vulnerability was resolved in commit 75c12c6fb4c22ec2cbde0051da24776d2dffa868 within packages/nitro-server/src/runtime/utils/event.ts. Prior to the fix, toWebView constructed the event URL inline via the default parameter resolveURL, passing both the path and base origin directly into the URL constructor.

File: packages/nitro-server/src/runtime/utils/event.ts
@@ -359,6 +359,17 @@ export function toRequestEvent (event: H3Event): RendererEvent {
   return requestEvent
 }
 
+// assigned through `pathname`, as a path starting with `//` would otherwise be read as a host
+function resolveEventURL (event: H3Event): URL {
+  const url = new URL(`${getRequestProtocol(event, { xForwardedProto: false })}://${getRequestHost(event)}`)
+  const path = encodeEventPath(event.path)
+  const queryIndex = path.indexOf('?')
+  url.pathname = queryIndex === -1 ? path : path.slice(0, queryIndex)
+  url.search = queryIndex === -1 ? '' : path.slice(queryIndex)
+  url.hash = ''
+  return url
+}
+
 /**
  * Describe an h3 v1 event in the web-standard shape, rather than adapting it in place:
  * `event.req` and `event.res` already name the node request and response, and that is the
@@ -368,7 +379,7 @@ export function toRequestEvent (event: H3Event): RendererEvent {
  * than a copy of it, so a header the application sets through h3 and a header the renderer
  * sets are the same header.
  */
-function toWebView (event: H3Event, resolveURL = () => new URL(encodeEventPath(event.path), `${getRequestProtocol(event, { xForwardedProto: false })}://${getRequestHost(event)}`)): RendererEvent {
+function toWebView (event: H3Event, resolveURL = () => resolveEventURL(event)): RendererEvent {
   const node = event.node
   let request: Request | undefined
   let url: URL | undefined

The patch introduces a dedicated helper function, resolveEventURL(event: H3Event), which separates origin initialization from path assignment:

function resolveEventURL (event: H3Event): URL {
  // 1. Initialize the URL object using only the trusted protocol and host
  const url = new URL(`${getRequestProtocol(event, { xForwardedProto: false })}://${getRequestHost(event)}`)
  const path = encodeEventPath(event.path)
  const queryIndex = path.indexOf('?')
  
  // 2. Assign the path directly via the pathname setter to prevent authority parsing
  url.pathname = queryIndex === -1 ? path : path.slice(0, queryIndex)
  url.search = queryIndex === -1 ? '' : path.slice(queryIndex)
  url.hash = ''
  return url
}

By instantiating new URL() with only the protocol and host, the origin (url.origin and url.host) is fixed before any user-controlled path characters are processed. Assigning the slice before ? directly to the url.pathname setter invokes the WHATWG path start state rather than the scheme start or relative state. In the path start state, leading double slashes are preserved as literal path characters (//x/admin) rather than being stripped and reinterpreted as a network host.

This fix is complete with respect to URL component smuggling via event.path. Because queryIndex explicitly splits the query string (url.search) and clears url.hash, and encodeEventPath normalizes special characters prior to assignment, the resulting url.pathname is guaranteed to remain synchronized with the path observed by H3 and Nitro. Regression tests added in packages/nitro-server/test/event-url.test.ts verify that //admin, //x/admin, and ///x/admin?y=1 retain their exact path structures in the renderer.

Exploiting CVE-2026-128077 requires no authentication or specialized tooling. Any Nuxt application running versions 4.6.0 through 4.6.3 is vulnerable if it relies on server-side path matching (server/middleware, serverHandlers, or routeRules) to enforce authentication, authorization, redirects, or security headers on SSR page routes.

Consider a Nuxt application that protects its /admin pages using a route-scoped server middleware configured in nuxt.config.ts and an authentication handler in server/admin-guard.ts:

// nuxt.config.ts
export default defineNuxtConfig({
  serverHandlers: [
    { route: '/admin', middleware: true, handler: '~~/server/admin-guard.ts' }
  ],
  routeRules: {
    '/admin/**': {
      headers: { 'Content-Security-Policy': "default-src 'self'" }
    }
  }
})
 
// server/admin-guard.ts
export default defineEventHandler((event) => {
  if (!isAuthenticated(event)) {
    throw createError({ statusCode: 401, statusMessage: 'Unauthorized' })
  }
})

Under normal conditions, an unauthenticated request to GET /admin matches the /admin route pattern in serverHandlers, triggers server/admin-guard.ts, and terminates with an HTTP 401 Unauthorized response. Similarly, a custom middleware checking if (event.path.startsWith('/admin')) would intercept the request.

To bypass these controls, an attacker sends an HTTP request with a leading double slash and an arbitrary dummy host segment (x) prepended to the target path:

GET //x/admin HTTP/1.1
Host: vulnerable-nuxt-app.example.com
Accept: text/html

When Nitro processes this request, event.path is //x/admin. Neither the /admin route handler nor the /admin/** route rule matches //x/admin. The request bypasses server/admin-guard.ts and skips the Content-Security-Policy header injection. When the request reaches the Nuxt SSR renderer, new URL('//x/admin', 'http://vulnerable-nuxt-app.example.com') resolves url.pathname to /admin, rendering app/pages/admin.vue and executing any top-level useFetch or useAsyncData calls defined inside the page component.

> [!NOTE] > Because web browsers send paths beginning with // (such as https://example.com//x/admin) verbatim in the HTTP request line without collapsing the slashes on the client side, an attacker can also trigger this bypass via a standard HTML link or top-level navigation.

CVE-2026-128077 is scored at CVSS v3.1 6.5 (Medium) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N. The attack vector is network-accessible (AV:N), has low complexity (AC:L), requires no privileges (PR:N) or user interaction (UI:N), and impacts both confidentiality (C:L) and integrity (I:L) within the scope of the application (S:U).

The primary confidentiality impact is unauthorized access to server-rendered Vue pages and the data fetched during their SSR lifecycle. In Nuxt applications where server-side data fetching within a page component relies on upstream server/middleware having already verified the user's session or role, bypassing the middleware causes the page component to render and serialize sensitive data into the HTML response and __NUXT_DATA__ payload.

The integrity impact stems from the ability to bypass server-side routeRules redirects (such as '/admin/**': { redirect: '/login' }) and per-route response headers (such as Content-Security-Policy, X-Frame-Options, or cache-control directives). Omitting security headers on sensitive routes can expose those pages to secondary client-side attacks such as framing or script injection if other weaknesses exist.

Several components and versions remain unaffected by this vulnerability:

• API and Server Routes: Handlers defined in server/api/* and server/routes/* are matched directly by Nitro's router, which does not strip the //x prefix and therefore returns a 404 Not Found for double-slash paths.
• Vue Router / Page Middleware: Client and universal middleware declared via definePageMeta({ middleware: [...] }) or appMiddleware route rules evaluate against the resolved Vue router path (/admin) and continue to execute as expected.
• Prior Release Lines: Nuxt 3.x and Nuxt 4.0.0 through 4.5.x pass the raw request path to the page router without URL authority parsing, causing //x/admin requests to result in a 404 error.

The definitive remediation for CVE-2026-128077 is to upgrade nuxt and @nuxt/nitro-server to version 4.6.4 or later. In version 4.6.4, the SSR renderer assigns the request path directly via url.pathname, ensuring that the renderer and Nitro evaluate the exact same path string.

# Upgrade Nuxt using npm, pnpm, or yarn
npm install nuxt@^4.6.4
pnpm update nuxt
yarn upgrade nuxt

After updating the package manifest, verify that the lockfile resolves @nuxt/nitro-server to 4.6.4 or higher (e.g., via npm ls @nuxt/nitro-server), as @nuxt/nitro-server is the transitive dependency containing the vulnerable toWebView implementation.

If an immediate upgrade to 4.6.4 is not feasible, deploy a global server middleware at the beginning of the middleware chain that rejects any request path starting with // before page rendering occurs:

// server/middleware/00.reject-double-slash.ts
export default defineEventHandler((event) => {
  if (event.path.startsWith('//')) {
    throw createError({
      statusCode: 404,
      statusMessage: 'Not Found'
    })
  }
})

Alternatively, configure the upstream reverse proxy, load balancer, or CDN to normalize and collapse consecutive forward slashes in the request URI prior to forwarding traffic to the Nuxt server. For example, in Nginx, ensure that the merge_slashes on; directive (enabled by default in the http or server block) is active so that //x/admin is rewritten to /x/admin before reaching Nitro.