Nuxt versions 4.6.0 through 4.6.1 contain a route parameter confusion flaw in the getRouterParam and getRouterParams helper functions. By encoding a question mark (%3F) inside a path component, an attacker can cause the framework to return a different value when the parameter is accessed through the helper than when it is retrieved from the routing context. If an application authorises a request by comparing the helper value to a known credential but selects resources using event.context.params, the mismatch enables the attacker to bypass access checks and retrieve data that should be restricted.

The target is the Nuxt framework itself. Versions 4.6.0, 4.6.1, and any intermediate builds prior to the release of 4.6.2 are affected. Projects built with these releases that rely on getRouterParam for authentication or authorization should be considered at risk. The vulnerability is present in the core Nuxt package and its Nitro server component.

The CVSS base score of 6.3 places this flaw in the medium severity range. EPSS data is not listed, and the vulnerability is not yet catalogued in CISA's KEV database, suggesting that active exploitation is not known. However, because the flaw can be triggered by a crafted HTTP request containing an encoded question mark, any public‑facing Nuxt application could be vulnerable. Attackers need only send a malicious URL and may be able to read or modify protected resources without additional privileges. Organizations running affected versions should consider the risk moderate to high.