Nuxt, an open‑source Vue.js framework, compared route‑rule keys against the raw request path while decoding dynamic and catch‑all parameters during route resolution. This inconsistency allowed an attacker to encode a path segment in percent form, causing the request to resolve to a protected page without matching the intended routeRule. As a result, the framework’s appMiddleware could be bypassed during server‑side rendering, enabling an unauthenticated user to receive the gated page and its server‑rendered data. The vulnerability also applies to app‑manifest rules such as redirect, appLayout, ssr, prerender, and payload flags derived from cache, isr, or swr, potentially exposing additional protected content.

Nuxt versions from 3.11.0 through 3.21.4 inclusive, and all Nuxt 4.x releases before 4.4.4 are affected. The fix was introduced in Nuxt v3.21.4 and v4.4.4, so deployments using these earlier ranges and employing routeRule, redirect, appLayout, ssr, prerender, or payload flags are at risk.

The CVSS base score of 6.5 denotes moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. Likely vectors involve a direct HTTP request to a protected route that contains a percent‑encoded segment; no privileged access is required. Once the bypass is successful, the attacker can view content and SSR data that should have been gated behind authentication.