CVE-2026-120309
Low · 3.7CVSS
3.7
EPSS
0.2%
Published
Nov 2, 2026
CISA due date
—
The record
Nuxt from 4.6.0 before 4.6.2 contains a route parameter confusion vulnerability in getRouterParam and getRouterParams that lets attackers return a parameter value different from the one h3 matched by sending paths containing an encoded question mark (%3F). Attackers can craft requests where authorization checks use the Nuxt helper value while resource selection uses event.context.params, allowing access to unauthorized resources.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-121135 Security issue in Platform in Google Chrome prior to 157.0.8103.38 allowed a remote… CWE-436
- CVE-2026-120213 @fastify/http-proxy is a Fastify plugin that proxies HTTP requests to an upstream server… CWE-436
- CVE-2026-61789 DBHub is a database MCP server for Postgres, MySQL, SQL Server, Oracle, MariaDB, SQLite. CWE-436
- CVE-2026-119200 Nuxt is an open-source web development framework for Vue.js. CWE-436
- CVE-2026-119190 Forge (also called node-forge) is a native implementation of Transport Layer Security in… CWE-436
- CVE-2026-116266 MIME::Head versions from 5.518 before 5.521 for Perl decode a partly encoded multipart… CWE-436
- CVE-2026-116272 MIME::Field::ParamVal versions before 5.521 for Perl do not flag a duplicate boundary… CWE-436
- CVE-2026-116269 MIME::Field::ParamVal versions before 5.521 for Perl turn an RFC 2231 filename with a… CWE-436