Is CVE-2026-114131 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-114131 being exploited in the wild.

How severe is CVE-2026-114131?

Medium severity, with a CVSS score of 6.5, published 21 October 2026.

Which products and versions are affected?

nuxt (npm) >= 4.0.0, < 4.4.4, SEMVER:introduced=4.0.0,fixed=4.4.4; Nuxt 3.11.0 to 3.21.3, 4.0.0 to 4.4.3.

Is there a fix for CVE-2026-114131?

Yes. nuxt (npm): upgrade to 4.4.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-114131 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-114131?

Check whether you run nuxt (npm) or Nuxt at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-114131: Nuxt route-rule bypass via percent-encoded segments

Q: Which products and versions are affected?

nuxt (npm) >= 4.0.0, < 4.4.4, SEMVER:introduced=4.0.0,fixed=4.4.4; Nuxt 3.11.0 to 3.21.3, 4.0.0 to 4.4.3.

Q: Is there a fix for CVE-2026-114131?

Yes. nuxt (npm): upgrade to 4.4.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-114131 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-114131?

Check whether you run nuxt (npm) or Nuxt at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-114131 · Severity: medium · CVSS 6.5 · Published 2026-10-21

Nuxt is a web development framework for Vue.js applications. An attacker can bypass authentication middleware and access protected pages by sending requests with percent-encoded URL segments that resolve differently during server-side rendering. This allows unauthorized users to view gated content and sensitive data that should be restricted.

Technologies: nuxt (npm), Nuxt. Vendors: npm, Nuxt.

Quick answers

Is CVE-2026-114131 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-114131 being exploited in the wild.
How severe is CVE-2026-114131?: Medium severity, with a CVSS score of 6.5, published 21 October 2026.
Which products and versions are affected?: nuxt (npm) >= 4.0.0, < 4.4.4, SEMVER:introduced=4.0.0,fixed=4.4.4; Nuxt 3.11.0 to 3.21.3, 4.0.0 to 4.4.3.
Is there a fix for CVE-2026-114131?: Yes. nuxt (npm): upgrade to 4.4.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-114131 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-114131?: Check whether you run nuxt (npm) or Nuxt at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

nuxt (npm): upgrade to 4.4.4 or later
```
npm install nuxt@4.4.4
```

Technical details

A path-matching mismatch exists in Nuxt's route-rule evaluation: route-rule keys are compared against raw request paths while route resolution decodes percent-encoded segments. An attacker can craft requests with URL encoding (e.g., %2F for /) that fail to match the intended routeRules, bypassing appMiddleware, and the same logic applies to manifest rules (redirect, appLayout, ssr, prerender, payload, cache, isr, swr flags). A network request is all that is required; no authentication is needed.

Affected products

Nuxt Nuxt 3.11.0 to 3.21.3, 4.0.0 to 4.4.3

Identifiers

CVE-2026-114131
GHSA-6gq8-jgmh-3ffp

Timeline

2026-10-21: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.