Nuxt EUVD-2026-107414

Exploitation requires the target Nuxt application to gate pages using routeRules and/or appMiddleware on routes that contain dynamic or catch-all parameters, and the attacker must request a percent-encoded form of the protected path so the route-rule key (compared against the raw path) fails to match while route resolution decodes the parameter to the protected page. It applies to server-side rendering and the app-manifest rules (redirect, appLayout, ssr, prerender, and cache/isr/swr-derived payload flags). Affected versions are Nuxt 3.11.0 through 3.21.4 and 4.4.4; apps on patched releases, apps not using route-level gating, or routes without dynamic/catch-all parameters are not exposed. No end-user interaction or attacker authentication is required, but the vulnerability is inert without the specific gating configuration.

This is a genuine but moderate-priority authorization-bypass/information-disclosure flaw rather than a critical issue. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, base 6.5) indicates remote, low-complexity, unauthenticated exploitation with no user interaction - attractive signals for an attacker. However, exploitability is heavily conditioned on the victim application: it only matters when the app relies on Nuxt routeRules/appMiddleware to gate pages that use dynamic or catch-all route parameters, so real-world impact depends on deployment choices, not default behavior. No EPSS score, KEV listing, or public POC was supplied in the input, so there is no evidence of active exploitation or automated weaponization at this time: exploitation status is 'no public exploit identified at time of analysis.' CWE-436 (interpretation conflict) is consistent with the described parser/matcher mismatch between the raw request path and the decoded route parameters. The impact rating is CONFIRMED by the description as confidentiality-biased (gated page plus SSR data disclosure) with some integrity effect via altered app-manifest rules (redirect, appLayout, ssr, prerender, cache/isr/swr payload flags); availability is unaffected. Net: a real but configuration-dependent priority - patch promptly on Nuxt apps that use route-level gating, lower urgency otherwise.

An unauthenticated attacker targets a Nuxt app that protects certain SSR pages via appMiddleware/routeRules on dynamic or catch-all routes. By requesting a percent-encoded variant of the protected path (e.g. encoding a path segment), the route-rule key comparison misses the intended rule while route resolution still decodes the parameter to the protected page, so the server renders and returns the gated page and its SSR data. No public exploit was provided in the input, but the technique is simple to reproduce by hand once the gated path is known.