CVE-2026-114132: Case-Sensitivity Route Rule Bypass in Nuxt Framework

Vulnerability ID: CVE-2026-114132

CVSS Score: 6.3

Published: 2026-10-22

Nuxt versions prior to 4.6.2 suffer from a route rule bypass vulnerability caused by an architectural mismatch in case-sensitivity handling between the Nitro server runtime and the Vue page router. An unauthenticated remote attacker can bypass server-enforced route directives—such as redirects, security headers, and SSR controls—by altering character casing in HTTP request paths.

TL;DR

A case-sensitivity mismatch between Nitro server route rules and the Nuxt Vue page router allows attackers to bypass security headers, redirects, and proxy rules by requesting paths with altered casing (e.g., /Admin/secret instead of /admin/secret ).

⚠️ Exploit Status: POC

Technical Details

CWE ID : CWE-178 / CWE-863

CVSS v4.0 Vector : CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

CVSS Score : 6.3 (Medium)

EPSS Score : 0.00314 (23.05th percentile)

Attack…