Nuxt has released version 4.6.4 to fix a collection of security issues, including a route-rule bypass affecting some dynamically matched pages. The November 2 release addresses eight Nuxt advisories and brings in Nitro fixes through nitropack 2.13.6.
The bypass comes from two parts of the framework interpreting the same address differently. According to the maintainer advisory, route-rule matching leaves an encoded slash, %2F, untouched, while the page router can decode it into a route parameter. A page may therefore render without the rules intended to protect its destination.
Where the exposure sits
The issue concerns catch-all page routes and custom routes whose parameters can cover several path segments. Depending on the application, the skipped rules can include authentication middleware, redirects and security headers. Whether private content is actually exposed also depends on how that page loads its data.
The advisory distinguishes these cases from static page routes, single-segment parameters and API handlers. It rates the issue Moderate, with a CVSS score of 6.5. Nuxt 3 is listed as affected, but maintainers say that branch has reached end of life and will not receive this fix.
Upgrade, then check the changed behavior
Version 4.6.4 updates how route rules handle encoded slashes. The release notes also flag changes to production error output, development-server host checks and cached responses. In particular, the updated Nitro dependency restricts cached routes to GET and HEAD requests and avoids caching responses that set cookies or explicitly disallow shared caching.
For application owners, the useful next step is a controlled upgrade followed by checks of the routes they rely on: sign-in gates, redirects, security headers and caching. Teams using a development tunnel or custom hostname should also review the new allowed-host configuration.
The advisory does not report confirmed exploitation.
Primary sources: Nuxt security advisory and Nuxt 4.6.4 release notes. Source documents published November 2, 2026.
Image: AI-generated editorial illustration created for DaySec. It does not depict an actual incident or product interface.
