Is CVE-2026-114132 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-114132 being exploited in the wild.

How severe is CVE-2026-114132?

Medium severity, with a CVSS score of 4, published 21 October 2026.

Which products and versions are affected?

@nuxt/nitro-server (npm) >= 4.2.0, = 4.0.0, < 4.6.2, SEMVER:introduced=4.0.0,fixed=4.6.2; Nuxt prior to 4.6.2.

How is CVE-2026-114132 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-114132?

Check whether you run @nuxt/nitro-server (npm), nuxt (npm) or Nuxt at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-114132: Nuxt case-sensitive route matching bypass

Q: Is there a fix for CVE-2026-114132?

Yes. @nuxt/nitro-server (npm): upgrade to 4.6.2 or later; nuxt (npm): upgrade to 4.6.2 or later. Until then: Set router.options.sensitive: true in nuxt.config to enforce case-sensitive routing, though this must be configured at the nuxt.config level rather than app/router.options.ts to be effective for server-side rule matching. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-114132 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-114132?

Check whether you run @nuxt/nitro-server (npm), nuxt (npm) or Nuxt at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-114132 · Severity: medium · CVSS 4 · Published 2026-10-21

Nuxt is a web development framework for building Vue.js applications. Prior to version 4.6.2, Nuxt resolved page routes case-insensitively while its server-side route rules used case-sensitive matching, allowing attackers to bypass security rules like redirects, headers, and proxy settings by requesting pages with different letter casing. This could expose sensitive content or allow unauthorized access to restricted pages.

Technologies: @nuxt/nitro-server (npm), nuxt (npm), Nuxt. Vendors: npm, Nuxt.

Quick answers

Is CVE-2026-114132 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-114132 being exploited in the wild.
How severe is CVE-2026-114132?: Medium severity, with a CVSS score of 4, published 21 October 2026.
Which products and versions are affected?: @nuxt/nitro-server (npm) >= 4.2.0, < 4.6.2, SEMVER:introduced=4.2.0,fixed=4.6.2; nuxt (npm) >= 4.0.0, < 4.6.2, SEMVER:introduced=4.0.0,fixed=4.6.2; Nuxt prior to 4.6.2.
Is there a fix for CVE-2026-114132?: Yes. @nuxt/nitro-server (npm): upgrade to 4.6.2 or later; nuxt (npm): upgrade to 4.6.2 or later. Until then: Set router.options.sensitive: true in nuxt.config to enforce case-sensitive routing, though this must be configured at the nuxt.config level rather than app/router.options.ts to be effective for server-side rule matching. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-114132 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-114132?: Check whether you run @nuxt/nitro-server (npm), nuxt (npm) or Nuxt at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@nuxt/nitro-server (npm): upgrade to 4.6.2 or later
```
npm install @nuxt/nitro-server@4.6.2
```
nuxt (npm): upgrade to 4.6.2 or later
```
npm install nuxt@4.6.2
```

Set router.options.sensitive: true in nuxt.config to enforce case-sensitive routing, though this must be configured at the nuxt.config level rather than app/router.options.ts to be effective for server-side rule matching.

Technical details

A case-sensitivity mismatch between Nuxt's page resolution (case-insensitive by default) and Nitro's server route rule matching (case-sensitive) allows an attacker to circumvent route rules via case variants of a URL path. The vulnerability affects redirect, headers, proxy, ssr: false, noScripts, and route rule matching functions. Applications with router.options.sensitive: true set in nuxt.config are not affected; this setting in app/router.options.ts alone does not provide protection. The fix in 4.6.2 aligns server route rule matching to be case-insensitive unless routing is explicitly sensitive.

Affected products

Nuxt Nuxt prior to 4.6.2

Identifiers

CVE-2026-114132
GHSA-vjh5-4x84-xrqp

Timeline

2026-10-15: other: Fix committed
2026-10-16: patched: Version 4.6.2 released
2026-10-21: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.