Description
Since 4.6.0, Nuxt resolves . and .. segments in the request path, including percent-encoded forms such as %2e, before rendering a page. Nitro’s routing, Nitro’s route rules and server/middleware see the path with those segments still in place.
Recommendation
Update the @nuxt/nitro-server package to the latest compatible version. Followings are version details:
- Affected version(s): >= 4.6.0, < 4.6.3
- Patched version(s): 4.6.3
References
Could your website be exposed too?
SmartScanner can check your website for Nuxt: Dot segments in the request path bypass `server/middleware` path checks and server route rules on page routes and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Nuxt's route middleware is not enforced when rendering `.server.vue` pages via `/__nuxt_island/page_*` - CVE-2026-47200
- Nuxt: Server-side route rules (`redirect`, `headers`, `proxy`, `ssr`) are skipped for case-variant paths when routing is - CVE-2026-114132
- Official Clerk JavaScript SDKs: Middleware-based route protection bypass - CVE-2026-41248
- Nuxt: `__nuxt_island` endpoint does not bind responses to request props, enabling shared-cache poisoning - CVE-2026-46342
You might also like:
See something that needs correcting? Let us knowUpdated October 30, 2026