CVE-2026-114132

## Impact With the default `router.options.sensitive: false`, Nuxt's page router resolves routes case-insensitively, so `/Admin` renders the same page as `/admin`. On the server, however, route rules were resolved with Nitro's route-rule matcher, which matches keys case-sensitively. A request whose path differs from a rule key only in letter case therefore rendered the page with none of that rule applied. Earlier fixes ([GHSA-mm7m-92g8-7m47](https://github.com/nuxt/nuxt/security/advisories/GHSA-mm7m-92g8-7m47), [GHSA-hxvh-4h3w-prp9](https://github.com/nuxt/nuxt/security/advisories/GHSA-hxvh-4h3w-prp9)) case-folded the route rules that the Nuxt app itself reads, such as `appMiddleware`. This advisory covers the rules applied on the server: - `redirect`: a rule used to send visitors away from a page, such as `'/admin/**': { redirect: '/login' }`, was skipped, and the page and its server-fetched data were rendered instead. - `headers`: per-route response headers, including security headers such as `Content-Security-Policy` or `X-Frame-Options`, were not sent. - `proxy`: the request was not proxied. - `ssr: false` and `noScripts`: the page was server-rendered, or shipped scripts, despite the rule. - `getRouteRules(event)` (auto-imported, or from `nuxt/server`) and `matchRouteRules` from `nuxt/server` returned no rules for the case variant. ```ts export default defineNuxtConfig({ routeRules: { '/admin/**': { redirect: '/login' }, }, }) ``` With this configuration, `/admin/secret` redirects to `/login`, but `/Admin/secret` rendered `app/pages/admin/secret.vue`. ## Mitigating factors - Applications that set `router.options.sensitive: true` in `nuxt.config` are not affected, because their pages are only served for the exact case of the route. - Access checks performed in server middleware, route middleware attached with `definePageMeta`, or in the page's data fetching are not affected. The issue only affects protections that rely on a server-side route rule m