# CVE-2026-114131: Nuxt route-rule bypass via percent-encoded segments

Source: https://junglewise.ai/threats/cve-2026-114131-nuxt-is-an-open-source-web-development-framework-for-vue-js-from  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-21. Updated: 2026-10-21  
License: CC BY 4.0 with a link back

CVE-2026-114131 · Severity: medium · CVSS 6.5 · Published 2026-10-21

Nuxt is a web development framework for Vue.js applications. An attacker can bypass authentication middleware and access protected pages by sending requests with percent-encoded URL segments that resolve differently during server-side rendering. This allows unauthorized users to view gated content and sensitive data that should be restricted.

Technologies: [nuxt (npm)](https://junglewise.ai/threats/technologies/nuxt), [Nuxt](https://junglewise.ai/threats/technologies/nuxt-nuxt). Vendors: [npm](https://junglewise.ai/threats/vendors/npm), [Nuxt](https://junglewise.ai/threats/vendors/nuxt).

## Quick answers

**Is CVE-2026-114131 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-114131 being exploited in the wild.

**How severe is CVE-2026-114131?** Medium severity, with a CVSS score of 6.5, published 21 October 2026.

**Which products and versions are affected?** nuxt (npm) >= 4.0.0, < 4.4.4, SEMVER:introduced=4.0.0,fixed=4.4.4; Nuxt 3.11.0 to 3.21.3, 4.0.0 to 4.4.3.

**Is there a fix for CVE-2026-114131?** Yes. nuxt (npm): upgrade to 4.4.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-114131 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-114131?** Check whether you run nuxt (npm) or Nuxt at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- nuxt (npm): upgrade to 4.4.4 or later

  ```sh
  npm install nuxt@4.4.4
  ```


## Technical details

A path-matching mismatch exists in Nuxt's route-rule evaluation: route-rule keys are compared against raw request paths while route resolution decodes percent-encoded segments. An attacker can craft requests with URL encoding (e.g., %2F for /) that fail to match the intended routeRules, bypassing appMiddleware, and the same logic applies to manifest rules (redirect, appLayout, ssr, prerender, payload, cache, isr, swr flags). A network request is all that is required; no authentication is needed.

## Affected products

- Nuxt Nuxt 3.11.0 to 3.21.3, 4.0.0 to 4.4.3

## Identifiers

- CVE-2026-114131
- GHSA-6gq8-jgmh-3ffp

## Timeline

- 2026-10-21: disclosed

## References

- [https://github.com/nuxt/nuxt/commit/81f86ac5ee82bb1a9b887e59f3bc84624d711497](https://github.com/nuxt/nuxt/commit/81f86ac5ee82bb1a9b887e59f3bc84624d711497)
- [https://github.com/nuxt/nuxt/commit/9123ed850c468a7424a868c20d0d49a5507d32e5](https://github.com/nuxt/nuxt/commit/9123ed850c468a7424a868c20d0d49a5507d32e5)

## Related threats

- [Nuxt information disclosure in development server appSecret](https://junglewise.ai/threats/cve-2026-119201-nuxt-is-an-open-source-web-development-framework-for-vue-js-from)
- [Nuxt path traversal via dot segment normalization bypass](https://junglewise.ai/threats/cve-2026-119200-nuxt-is-an-open-source-web-development-framework-for-vue-js-from)
- [Nuxt development server secrets exposure in bundled configuration](https://junglewise.ai/threats/cve-2026-119199-nuxt-is-an-open-source-web-development-framework-for-vue-js-from)
- [Nuxt arbitrary file read in development server HMR](https://junglewise.ai/threats/cve-2026-119198-nuxt-is-an-open-source-web-development-framework-for-vue-js-from)
- [Nuxt stored cross-site scripting in useHeadSafe server island rendering](https://junglewise.ai/threats/cve-2026-114133-nuxt-is-an-open-source-web-development-framework-for-vue-js-from)