{"affected":[{"product":"nuxt","source":"CNA: GitHub_M","vendor":"nuxt","versions":[{"status":"affected","version":">= 4.6.0, < 4.6.3"}]},{"product":"nitro-server","source":"CNA: GitHub_M","vendor":"@nuxt","versions":[{"status":"affected","version":">= 4.6.0, < 4.6.3"}]},{"defaultStatus":"unaffected","ecosystem":"npm","packageName":"nuxt","product":"nuxt","source":"OSV GHSA-9v7c-q64q-vv33","vendor":"","versions":[{"events":[{"introduced":"4.6.0"},{"fixed":"4.6.3"}],"lessThan":"4.6.3","status":"affected","version":"4.6.0","versionType":"semver"}]},{"defaultStatus":"unaffected","ecosystem":"npm","packageName":"@nuxt/nitro-server","product":"@nuxt/nitro-server","source":"OSV GHSA-9v7c-q64q-vv33","vendor":"","versions":[{"events":[{"introduced":"4.6.0"},{"fixed":"4.6.3"}],"lessThan":"4.6.3","status":"affected","version":"4.6.0","versionType":"semver"}]}],"cveId":"CVE-2026-119200","cwes":["CWE-41","CWE-436","CWE-863"],"description":"Nuxt is an open-source web development framework for Vue.js. From 4.6.0 until 4.6.3, Nuxt resolves literal or percent-encoded dot segments before rendering a page while Nitro routing, server/middleware checks, and server route rules evaluate the unresolved path. A request such as /%2e/admin can therefore render app/pages/admin.vue and its server-rendered data while checks keyed to /admin, redirects, or per-route security headers do not apply. API handlers, appMiddleware, Nuxt 3, and Nuxt 4.0.0 through 4.5.x are not affected, and exploitation requires a client that sends dot segments without browser normalization. This issue is fixed in version 4.6.3.","epss":{"date":"2026-11-03","percentile":0.27383,"score":0.00339},"exploits":[],"kev":null,"metrics":[{"score":6.5,"severity":"medium","source":"CNA: GitHub_M","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","version":"3.1"}],"modifiedAt":1793756486806,"publishedAt":1793305028837,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/nuxt/nuxt/security/advisories/GHSA-9v7c-q64q-vv33"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/nuxt/nuxt/commit/45463f8b58487e387149ebfb704d6a0834b3a450"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/nuxt/nuxt/releases/tag/v4.6.3"},{"source":"OSV / GitHub Security Advisories","tags":["advisory"],"url":"https://github.com/advisories/GHSA-9v7c-q64q-vv33"},{"source":"OSV / GitHub Security Advisories","tags":["osv"],"url":"https://osv.dev/vulnerability/GHSA-9v7c-q64q-vv33"}],"remediation":[{"kind":"fix","source":"OSV GHSA-9v7c-q64q-vv33","text":"nuxt (npm): OSV reports a fixed version 4.6.3. Check the advisory for supported release branches.","url":"https://github.com/advisories/GHSA-9v7c-q64q-vv33"},{"kind":"fix","source":"OSV GHSA-9v7c-q64q-vv33","text":"@nuxt/nitro-server (npm): OSV reports a fixed version 4.6.3. Check the advisory for supported release branches.","url":"https://github.com/advisories/GHSA-9v7c-q64q-vv33"}],"revision":"ce23d590b2891de786717bae164bb012b096f5c9f4abf5b9629cd1e74dc5874d","sources":[{"modifiedAt":1793756486806,"name":"CNA: GitHub_M","retrievedAt":1793758143048,"url":"https://www.cve.org/CVERecord?id=CVE-2026-119200"},{"modifiedAt":1793402107324,"name":"OSV / GitHub Security Advisories","retrievedAt":1793758144546,"url":"https://osv.dev/vulnerability/GHSA-9v7c-q64q-vv33"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793758171316,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-119200"}],"ssvc":{"assessedAt":1793756478080,"automatable":"yes","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"Nuxt: Dot segments in the request path bypass `server/middleware` path checks and server route rules on page routes","updatedAt":1793758171316}