CVE-2026-120309
Nuxt 4.6.0 before 4.6.2 Route Param Confusion via getRouterParam
Nuxt from 4.6.0 before 4.6.2 contains a route parameter confusion vulnerability in getRouterParam and getRouterParams that lets attackers return a parameter value different from the one h3 matched by sending paths containing an encoded question mark (%3F). Attackers can craft requests where authorization checks use the Nuxt helper value while resource selection uses event.context.params, allowing access to unauthorized resources.
Fixes and workarounds
No remediation reported in collected sources.
Missing remediation information is not evidence that no patch exists.
Affected products and versions
| Product | Versions | Authority |
|---|---|---|
| nuxt nuxt nuxt
npm |
≥ 4.6.0; < 4.6.2 (affected, semver) 4.6.2 (unaffected, semver) Other versions: unaffected |
CNA: VulnCheck |
| nuxt nuxt %40nuxt/nitro-server
npm |
≥ 4.6.0; < 4.6.2 (affected, semver) 4.6.2 (unaffected, semver) Other versions: unaffected |
CNA: VulnCheck |
Version ranges are source assertions. Check the vendor advisory and your installed configuration before determining exposure.
CVSS assessments
| Version / score | Vector | Authority |
|---|---|---|
| 4.0 / 6.3 medium |
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N | CNA: VulnCheck |
| 3.1 / 3.7 low |
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N | CNA: VulnCheck |
Exploit evidence
No exploit evidence in collected sources. This is not proof of no exploitation.
References
- https://github.com/nuxt/nuxt/security/advisories/GHSA-w7gw-66vg-99gqCNA: VulnCheck · vendor-advisory
- https://www.vulncheck.com/advisories/nuxt-4.6.0-before-4.6.2-route-param-confusion-via-getrouterparamCNA: VulnCheck · third-party-advisory