Nuxt EUVD-2026-114998

Exploitation requires the target to run Nuxt (or @nuxt/nitro-server) >=4.6.0 <4.6.2 AND to use an application pattern that reads the same route param from two different sources that must agree - specifically, using getRouterParam/getRouterParams from nuxt/server for one decision (e.g. an authorization check) while using event.context.params or another h3 helper for another decision (e.g. resource selection). The trigger is a request path containing an encoded question mark (%3F) in a param segment, which causes h3 to route on the decoded path up to the '?' while the Nuxt helper reads from mis-aligned raw segments, returning a different value. Named ([id]), unnamed, and catch-all ([...slug]) params are all affected. LIMITING factors: applications reading params exclusively through getRouterParam(s) OR exclusively through event.context.params/h3 helpers are NOT affected; Nuxt 3 and releases before 4.6.0 are NOT affected (helpers introduced in 4.6.0); high attack complexity and the non-default dual-source dependency (reflected as AC:H/AT:P) materially constrain real-world exploitability.

This is a moderate, conditional authorization-bypass issue (CWE-436 Interpretation Conflict / CWE-863 Incorrect Authorization) rather than a broad critical flaw. The CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:N/VC:L) describes a network-reachable, unauthenticated vector but with high attack complexity (AC:H) and an explicit attack requirement (AT:P): exploitation only works against an application that reads the same route param from two different sources and relies on them agreeing. The vuln.today priority is 'this_month' (not act_now/emergency), consistent with a real but non-urgent issue. No KEV listing and no EPSS score are provided in the input, and there is no confirmed public exploit code - only VulnCheck and GHSA advisory references, not a verified working PoC. The signals are therefore internally consistent: real severity is gated by a non-default application coding pattern, so this is a genuine priority for teams running the affected versions with the vulnerable dual-source pattern, but not a widespread mass-exploitation threat. Note the input CVSS is 4.0 only; no CVSS 3.1 vector was supplied, and no EPSS/KEV data was provided to confirm or contradict exploitation likelihood.

An attacker targets a Nuxt 4.6.0/4.6.1 API route such as server/api/auth/[...slug] that performs an authorization check using getRouterParam from nuxt/server but selects the resource from event.context.params. The attacker sends a request like /api/auth/private%3Fignored/public, where h3 matches slug='private' while getRouterParam returns 'public', so the request passes the authorization check for one resource while acting on another. No public exploit code is confirmed in the input, but the GHSA advisory documents the exact technique; exploitation is unauthenticated (PR:N) but high-complexity (AC:H) and depends on the app's dual-source pattern.