Nuxt 4.6.4 Fixes 8 Advisories, 16 Since 4.6.2; Nuxt 3 Gets No Patch

• Severity: the advisories are rated medium or low; the highest CVSS 3.1 score is 6.5, for three route-rule and middleware bypasses.
• Production impact: route rules and server/middleware checks could be bypassed with crafted paths, unhandled server errors could leak their message and data, and wildcard redirects could leave their scope.
• Development impact: several advisories let a malicious page or a client read files, private runtime config or the generated app secret from a running nuxt dev server.
• Behaviour changes in 4.6.4 that the release notes flag: error pages carry only createError details, webpack and rspack dev servers reject unexpected Host headers unless listed in devServer.allowedHosts, and route rules now match paths with encoded slashes.

Route Rule and Middleware Bypasses in Production #

The most serious group concerns request paths that slip past rules meant to protect them. In 4.6.3, dot segments in a path could bypass server/middleware checks and server route rules on page routes (GHSA-9v7c-q64q-vv33, CVE-2026-119200, 6.5). 4.6.4 closes two incomplete fixes: a leading // still bypassed the middleware check (GHSA-r99w-jh2x-3mg9, 6.5), and an encoded slash, %2F, still bypassed route rules, the gap left by the fix for GHSA-6gq8-jgmh-3ffp (GHSA-f3x9-2chm-73c8, 6.5). Earlier, 4.6.2 made server route rules match case-insensitively, because case-variant paths had skipped redirect, headers, proxy and ssr rules after the earlier case-folding fixes GHSA-mm7m-92g8-7m47 and GHSA-hxvh-4h3w-prp9 (GHSA-vjh5-4x84-xrqp, CVE-2026-114132).

Other production fixes: unhandled errors thrown during server rendering exposed their message and data (GHSA-96x6-fvhx-49hg, 5.3), server islands rendered useHeadSafe input without sanitising it (GHSA-xfq5-w38q-pc2x, CVE-2026-114133, 5.4), and the server island endpoint ignored redirect rules for .server.vue pages (GHSA-2fxj-c3j7-rr69, 3.7). Colliding island props could share one /__nuxt_island path, an incomplete fix for CVE-2026-46342, GHSA-g8wj-3cr3-6w7v (GHSA-hf59-9xwc-2g4p, 3.1). Wildcard redirect rules in the Vite server builder could redirect to another origin (GHSA-p4h3-4h99-9665), payload URL generation had quadratic cost for repeated slashes (GHSA-r9jc-w898-3fv6), and getRouterParam could return a different parameter from the one h3 matched (GHSA-w7gw-66vg-99gq).

Development Server Exposures #

Five advisories concern nuxt dev, so they matter on developer machines and on any dev server reachable from a network. In 4.6.3, the dev server could read arbitrary files through client error reports (GHSA-x287-wcfc-q46c, CVE-2026-119198, 5.9), expose private runtime config through the Nitro dev bundle (GHSA-648h-gw55-m2g7, CVE-2026-119199, 5.9) and serve a generated appSecret through Vite file serving (GHSA-3xf4-9g3c-4h4w, CVE-2026-119201, 4.8). In 4.6.4, the dev server could serve files from a parent directory that holds a stray lockfile or workspace file (GHSA-mjrq-cffv-q4qc, 5.9), and the webpack and rspack dev servers served built source to DNS rebinding pages, bypassing the same-origin check added for GHSA-4gf7-ff8x-hq99, GHSA-6m52-m754-pw2g and GHSA-x6qj-4h56-5rj5 (GHSA-x2wv-5868-p7v2, 3.1).

Nuxt 3 Applications Have No Patched Version #

Each of these advisories lists its Nuxt 3 range with "no patched version listed". GHSA-2fxj-c3j7-rr69 also starts at 3.11.0, with 4.6.3 as the only fix.

What Nuxt Teams Should Do #

Nuxt 4 applications should upgrade to 4.6.4, which brings nitropack 2.13.6 with it, and then check the flagged behaviour changes: custom hostnames or tunnels used with webpack or rspack dev servers need an entry in devServer.allowedHosts, and cached routes now only cache GET and HEAD and skip responses that set a cookie or send Cache-Control: private or no-store. Nuxt 3 applications that rely on route rules, server/middleware or server islands for access control have no patched release and need a plan to move to Nuxt 4. Dev servers should not be reachable from untrusted networks until they run 4.6.4.