Nuxt EUVD-2026-107416

Exploitable only when the Nuxt application (prior to 4.6.2) defines server-side route rules - redirect, headers, proxy, ssr:false, or noScripts - and has NOT set router.options.sensitive:true in nuxt.config (because Nitro follows the nuxt.config value; setting sensitive only in app/router.options.ts does NOT establish the exclusion). The attacker needs no authentication and only varies letter case in the request path. Limiting factors that reduce real risk: applications that set sensitive:true in nuxt.config are entirely unaffected, and access controls enforced in server middleware, page route middleware, or page data fetching remain independent of this matcher and are NOT bypassed - so the flaw bypasses route-rule-based behavior, not genuine auth checks.

This is a moderate, configuration-dependent security-control bypass rather than a high-urgency flaw. The provided CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N) correctly signals remote, unauthenticated, low-complexity access but flags AT:P (attack requirement present), which captures that exploitation only matters when the app actually relies on server-side route rules AND has not set router.options.sensitive:true in nuxt.config. Impact is explicitly low on both confidentiality and integrity (VC:L/VI:L/VA:N), consistent with a bypass of redirect/headers/proxy/ssr:false/noScripts rather than code execution or full data compromise. No EPSS score, CISA KEV listing, or public POC is present in the input, so there is no signal of active or imminent widespread exploitation - this is a defense-in-depth/hardening issue, not a drop-everything priority. A key mitigating fact stated in the advisory itself: access checks in server middleware, page route middleware, and page data fetching are NOT affected, so this generally does not bypass real authentication/authorization, only route-rule-based behaviors. CWE-178 (improper case-sensitivity handling) matches the described page-vs-Nitro mismatch. Overall: a legitimate issue worth patching, but low real-world risk for most deployments and effectively zero for apps that already set sensitive:true in nuxt.config or that enforce access control in middleware.

An attacker requests a protected or specially-handled route using a different letter case (e.g. /Admin instead of /admin or /SECURE-Page). Because Nuxt resolves the page case-insensitively while Nitro matches route-rule keys case-sensitively, the case-variant path renders the page without the intended server route rule - skipping a redirect, security headers, proxy behavior, or an ssr:false/noScripts restriction. No public exploit identified at time of analysis; exploitation requires only varying the URL case and no authentication.