CVE-2026-119200: Nuxt: Dot segments in the request path bypass `server/middleware` path checks and server route rules on page routes

Since 4.6.0, Nuxt resolves . and .. segments in the request path, including percent-encoded forms such as %2e, before rendering a page. Nitro’s routing, Nitro’s route rules and server/middleware see the path with those segments still in place. A request for /%2e/admin therefore renders the page at /admin, while server-side checks keyed on /admin do not apply.