CVE-2026-120309

    Dashboard / Vulnerabilities / CVE-2026-120309

    CVE-2026-120309

    Published: 2 Nov 2026Last Modified: 4 Nov 2026

    Summary: Nuxt 4.6.0 before 4.6.2 Route Param Confusion via getRouterParam

    Details: Nuxt from 4.6.0 before 4.6.2 contains a route parameter confusion vulnerability in getRouterParam and getRouterParams that lets attackers return a parameter value different from the one h3 matched by sending paths containing an encoded question mark (%3F). Attackers can craft requests where authorization checks use the Nuxt helper value while resource selection uses event.context.params, allowing access to unauthorized resources.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/120xxx/CVE-2026-120309.json, https://github.com/nuxt/nuxt/security/advisories/GHSA-w7gw-66vg-99gq, https://nvd.nist.gov/vuln/detail/CVE-2026-120309, https://www.vulncheck.com/advisories/nuxt-4.6.0-before-4.6.2-route-param-confusion-via-getrouterparam

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 49da92fe0dc0cf97bd218167da822e2827232380
    Fixed -026e99314c5dfddc63de6d40c977b79c85c88bf8

    Affected versions

    v4.6.1
    v4.6.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-120309 | CVE-DB