Description
With the default router.options.sensitive: false, Nuxt’s page router resolves routes case-insensitively, so /Admin renders the same page as /admin. On the server, however, route rules were resolved with Nitro’s route-rule matcher, which matches keys case-sensitively.
Recommendation
Update the @nuxt/nitro-server package to the latest compatible version. Followings are version details:
Affected version(s): **>= 3.20.0, < 4.0.0 >= 4.2.0, < 4.6.2** - Patched version(s): 4.6.2
References
Could your website be exposed too?
SmartScanner can check your website for Nuxt: Server-side route rules (`redirect`, `headers`, `proxy`, `ssr`) are skipped for case-variant paths when routing is and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Nuxt's route middleware is not enforced when rendering `.server.vue` pages via `/__nuxt_island/page_*` - CVE-2026-47200
- Nuxt: Dot segments in the request path bypass `server/middleware` path checks and server route rules on page routes - CVE-2026-119200
- @angular/router: Denial of Service via Unmatched Empty-Path Outlet Route Matching in Server-Side Rendering (SSR) - CVE-2026-111752
- Nitro has an Open Redirect via Protocol-Relative URL Bypass in Wildcard Route Rules - nitro - CVE-2026-44372
You might also like:
See something that needs correcting? Let us knowUpdated October 22, 2026