Threats tagged 'ghsa-9v7c-q64q-vv33'

A path normalization vulnerability in Nuxt versions 4.6.0 through 4.6.2 allows bypassing server-side middleware and route rules by using dot segments ('.' and '..') or their percent-encoded forms in request paths. This causes the page router to resolve these segments before rendering, while server-side checks see the unnormalized path, enabling unauthorized access to protected pages. The issue is fixed in Nuxt 4.6.3, which returns 404 for such paths and normalizes route rule keys accordingly.