CVE-2026-128077: Authorization Bypass via Request Path Desynchronization in Nuxt and @nuxt/nitro-server

Vulnerability ID: CVE-2026-128077
CVSS Score: 6.5
Published: 2026-11-13

CVE-2026-128077 (GHSA-r99w-jh2x-3mg9) is an authorization bypass and interpretation conflict vulnerability affecting Nuxt and its underlying @nuxt/nitro-server package in versions 4.6.0 through 4.6.3. When an incoming HTTP request path begins with a double forward slash (e.g., //x/admin), the WHATWG URL parser within the Nuxt server-side page renderer interprets the initial segment as a network host/authority and resolves the remaining path (/admin) against the application's page router. Because Nitro server middleware, route-scoped serverHandlers, and Nitro routeRules evaluate the unparsed request path (//x/admin), path-based access controls, redirects, and security header policies configured for /admin fail to match and are bypassed.

TL;DR

An interpretation conflict between Nitro request routing and the Nuxt SSR page renderer in Nuxt 4.6.0 to 4.6.3 allows unauthenticated attackers to bypass server-side path checks, route-scoped handlers, and route rules by prefixing the request path with a double slash (e.g., //x/admin).

⚠️ Exploit Status: POC

Technical Details

Vulnerability ID: CVE-2026-128077 / GHSA-r99w-jh2x-3mg9
Weakness Class: CWE-436 (Interpretation Conflict) / CWE-863 (Incorrect Authorization)
CVSS v3.1 Score: 6.5 Medium (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
Attack Vector: Network (Unauthenticated HTTP GET with leading '//' in path)
Affected Versions: nuxt and @nuxt/nitro-server >= 4.6.0, < 4.6.4
Patched Version: 4.6.4
Primary Impact: Bypass of server/middleware, route-scoped serverHandlers, and Nitro routeRules on SSR pages
CISA KEV Status: Not Listed

Affected Systems

nuxt
@nuxt/nitro-server
nuxt: >= 4.6.0, < 4.6.4 (Fixed in: 4.6.4)
@nuxt/nitro-server: >= 4.6.0, < 4.6.4 (Fixed in: 4.6.4)

Code Analysis

Commit: 75c12c6

fix(nitro): keep leading double slash in renderer request path

File: packages/nitro-server/src/runtime/utils/event.ts @@ -359,6 +359,17 @@ export function toRequestEvent (event: H3Event): RendererEvent { return requestEvent } +// assigned through `pathname`, as a path starting with `//` would otherwise be read as a host +function resolveEventURL (event: H3Event): URL { + const url = new URL(`${getRequestProtocol(event, { xForwardedProto: false })}://${getRequestHost(event)}`) + const path = encodeEventPath(event.path) + const queryIndex = path.indexOf('?') + url.pathname = queryIndex === -1 ? path : path.slice(0, queryIndex) + url.search = queryIndex === -1 ? '' : path.slice(queryIndex) + url.hash = '' + return url +} + /** * Describe an h3 v1 event in the web-standard shape, rather than adapting it in place: * `event.req` and `event.res` already name the node request and response, and that is the @@ -368,7 +379,7 @@ export function toRequestEvent (event: H3Event): RendererEvent { * than a copy of it, so a header the application sets through h3 and a header the renderer * sets are the same header. */ -function toWebView (event: H3Event, resolveURL = () => new URL(encodeEventPath(event.path), `${getRequestProtocol(event, { xForwardedProto: false })}://${getRequestHost(event)}`)): RendererEvent { +function toWebView (event: H3Event, resolveURL = () => resolveEventURL(event)): RendererEvent { const node = event.node let request: Request | undefined let url: URL | undefined

Mitigation Strategies

Upgrade Nuxt and @nuxt/nitro-server to version 4.6.4 or later to eliminate the URL parsing discrepancy between Nitro and the SSR renderer.
Implement a high-priority global server middleware in server/middleware/ to reject incoming requests where event.path starts with '//'.
Configure upstream reverse proxies or CDNs (such as Nginx with merge_slashes on;) to collapse consecutive forward slashes in request URIs before forwarding to the origin server.
Enforce authorization checks inside Vue page middleware (definePageMeta / appMiddleware) and inside individual server API data endpoints in addition to path-based server middleware.

Remediation Steps:

Update the project's package.json to require nuxt@^4.6.4.
Run the package manager update command (npm install nuxt@^4.6.4, pnpm update nuxt, or yarn upgrade nuxt) and verify that @nuxt/nitro-server resolves to >= 4.6.4 in the lockfile.
Rebuild and redeploy the Nuxt application.
Verify the fix by sending an HTTP GET request to //x/ and confirming the server returns a 404 Not Found rather than rendering the protected page.