Nuxt: Dot segments in the request path bypass `server/middleware` path checks and server route rules on page routes

Summary Since 4.6.0, Nuxt resolves . and .. segments in the request path, including percent-encoded forms such as %2e, before rendering a page. Nitro's routing, Nitro's route rules and server/middleware see the path with those segments still in place. A request for /%2e/admin therefore renders the page at /admin, while server-side checks keyed on /admin do not apply. Impact An unauthenticated attacker can bypass server-side controls that match on the request path of a page route. server/middleware that checks event.path (or event.node.req.url) is skipped: ts export default defineEventHandler((event) => { if (event.path.startsWith('/admin') && !isAuthenticated(event)) { throw createError({ statusCode: 401 }) } }) With this middleware, /admin returns 401, but /%2e/admin, /.%2e/admin and /x/%2e%2e/admin reach the middleware with event.path set to /./admin, /../admin and /x/../admin, and render app/pages/admin.vue along with the data it fetches during server rendering. Server-side redirect and headers route rules are skipped in the same way, so '/admin/': { redirect: '/login' } does not redirect /%2e/admin/secret, and per-route security headers such as Content-Security-Policy are not…

curl https://cve.zerocrew.in/api/cve/CVE-2026-119200