CVE-2026-128077: Nuxt: Incomplete fix for GHSA-9v7c-q64q-vv33: a leading `//` in the request path bypasses `server/middleware` path checks and server route rules on page routes

November 13, 2026

Since 4.6.0, Nuxt parses a request path that starts with // as a URL with a host before rendering a page, so //x/admin renders the page at /admin. Nitro’s routing, Nitro’s route rules and server/middleware see the path as //x/admin, so server-side checks keyed on /admin do not apply. The fix for GHSA-9v7c-q64q-vv33 in 4.6.3 covered dot segments but not this form.

References

github.com/advisories/GHSA-r99w-jh2x-3mg9
github.com/nuxt/nuxt/commit/75c12c6fb4c22ec2cbde0051da24776d2dffa868
github.com/nuxt/nuxt/releases/tag/v4.6.4
github.com/nuxt/nuxt/security/advisories/GHSA-r99w-jh2x-3mg9
nvd.nist.gov/vuln/detail/CVE-2026-128077

Code Behaviors & Features

Detect and mitigate CVE-2026-128077 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →