- A GitHub advisory says Nuxt's server skipped redirect, header and other route rules when a URL differed from the rule only in letter case.
- Nuxt 4.6.2 fixes it. Nuxt 3 reached end of life on 31 July 2026 and gets no patch, so those teams need a workaround or a migration.
- Do not let a redirect rule be the only guard on a private page. Check access in server or route middleware.
A security rule works only if it reads names the same way as the system it guards. When the two disagree, a change as small as a capital letter can get past the rule. A GitHub advisory published on October 22, 2026 describes this gap in Nuxt, a web framework.
What the advisory says happened
The GitHub Advisory Database says Nuxt's server skipped some route rules. A route rule attaches behaviour to a URL path. It might send visitors elsewhere or add response headers.
The advisory gives an example. One rule redirects '/admin/**' to '/login'. A request for /admin/secret lands on the login page. A request for /Admin/secret instead loads the page app/pages/admin/secret.vue, along with its server-fetched data.
Several kinds of rule failed on the case variant. Redirects were skipped. Headers attached to a path did not go out. That includes the security headers Content-Security-Policy and X-Frame-Options.
Rules that switch off server rendering (ssr: false) or scripts (noScripts) were also ignored. The helper functions getRouteRules and matchRouteRules returned no rules. The advisory links to CVE-2026-114132 at the NVD.
How the mismatch works
By default, Nuxt's page router ignores letter case. The setting is router.options.sensitive, and it defaults to false. So /Admin and /admin show the same page.
The server looked up rules with a different tool, the route-rule matcher from Nitro. It counts case when it compares keys. The rule for '/admin/**' therefore matched /admin/secret but not /Admin/secret.
One layer said the page exists. The other said no rule applies. The visitor got the page with no rule attached.
This is not the first case problem in Nuxt. Two earlier advisories, GHSA-mm7m-92g8-7m47 and GHSA-hxvh-4h3w-prp9, dealt with case in the rules read by the app layer, such as appMiddleware. This advisory is about the rules the server applies.
Who is affected, and who is not
Any nuxt release below 4.6.2 is named, which takes in every Nuxt 3 version. So is @nuxt/nitro-server below 4.6.2.
Nuxt 3 passed its end-of-life date, 31 July 2026. The advisory says it will not get a fix. Teams still on Nuxt 3 cannot patch their way out, but the workarounds below apply. They also need a migration plan.
Some setups are not affected. Apps that set router.options.sensitive: true are clear, because their pages are served only for the exact case of the route. Access checks in server middleware, in route middleware attached with definePageMeta, or in a page's data fetching are also clear.
The weak spot is a protection whose only trigger is a server-side route rule that must match the requested path.
What the fix changes
Nuxt 4.6.2 does its own rule lookup on the server. It decodes the path and normalises case for both the rule keys and the request, unless sensitive is set. Nitro's redirect, header and proxy handling use that result. So do the renderer and the two helper functions.
The advisory warns that some behaviour changes. Rule keys that differ only in case now point to the same path, and the later key wins. A rule for /api/** now also matches /API/x. Case variants render with their rules applied, but their responses are not cached.
The fix does not change rules that a deployment preset hands to the hosting platform. The advisory names Vercel and Netlify as examples. The platform matches those rules itself. The patched lookup covers traffic only after it reaches the Nuxt server.
How common is Nuxt?
WebPulse scanned the Tranco top 10,000 domains in September 2026. Of 7,064 that responded, a platform was detected on 2,491. Nuxt was detected on 111 of those, or 4.5%. That shows presence only, not versions or route-rule use.
What to ask your team
Start with versions. Which applications run Nuxt, and are any on Nuxt 3? The advisory says the fix is [email protected].
Then ask whether a redirect rule is the only guard on any private page. The advisory suggests checking access in server middleware or route middleware instead. It also says to set security headers on every response, not per route.
If you cannot upgrade, the advisory's other workaround is router: { options: { sensitive: true } } in nuxt.config. Afterwards, request a private path in a different letter case. Confirm the answer matches the original.
The lesson is about where trust sits. A rule that names one spelling of a path protects only that spelling. Put the control in the layer that makes the decision, not in a list that must match it.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: GitHub Advisory Database.
