Threats tagged 'ghsa-r99w-jh2x-3mg9'

A path parsing flaw in Nuxt versions 4.6.0 through 4.6.3 allows an unauthenticated attacker to bypass server-side route controls by using request paths starting with double slashes (//). This causes server middleware and route rules keyed on normal paths (e.g., /admin) to be skipped, enabling unauthorized access to protected pages and skipping security headers or redirects. The issue is fixed in version 4.6.4.