Nuxt, an open‑source Vue.js framework, resolves page URLs case‑insensitively by default. Prior to version 4.6.2, Nitro’s server‑side route‑rule matching was case‑sensitive. This mismatch allowed requests whose path only in letter case to bypass the route rules intended for that page, causing redirects, headers, proxy logic, SSR disabling, or script execution to be ignored. As a result, unintended content could be served or legitimate security restrictions could be sidestepped. The issue does not affect application‑level access checks implemented in middleware or data fetching.

The vulnerability affects all Nuxt installations running a version earlier than v4.6.2 when the framework’s default case‑insensitive routing is enabled. The affected product is Nuxt (nuxt:nuxt). Applications that have explicitly set router.options.sensitive: true in nuxt.config are immune.

With a CVSS score of 6.3, the vulnerability presents moderate severity. EPSS is not available and the issue is not listed in CISA’s KEV catalog. The likely attack vector is sending an HTTP request to a case‑variant URL that matches a route but would otherwise trigger a server‑side rule. Because the attacker must know a valid route and the server is case‑insensitive, exploitation is possible in the exposed application but not trivial. No additional privileges are required beyond network access.