CVE-2026-114132: Nuxt: Server-side route rules (`redirect`, `headers`, `proxy`, `ssr`) are skipped for case-variant paths when routing is case-insensitive

With the default router.options.sensitive: false, Nuxt’s page router resolves routes case-insensitively, so /Admin renders the same page as /admin. On the server, however, route rules were resolved with Nitro’s route-rule matcher, which matches keys case-sensitively. A request whose path differs from a rule key only in letter case therefore rendered the page with none of that rule applied.

Earlier fixes (GHSA-mm7m-92g8-7m47, GHSA-hxvh-4h3w-prp9) case-folded the route rules that the Nuxt app itself reads, such as appMiddleware. This advisory covers the rules applied on the server:

• redirect: a rule used to send visitors away from a page, such as '/admin/**': { redirect: '/login' }, was skipped, and the page and its server-fetched data were rendered instead.
• headers: per-route response headers, including security headers such as Content-Security-Policy or X-Frame-Options, were not sent.
• proxy: the request was not proxied.
• ssr: false and noScripts: the page was server-rendered, or shipped scripts, despite the rule.
• getRouteRules(event) (auto-imported, or from nuxt/server) and matchRouteRules from nuxt/server returned no rules for the case variant.

export default defineNuxtConfig({
routeRules: {
'/admin/**': { redirect: '/login' },
},
})

With this configuration, /admin/secret redirects to /login, but /Admin/secret rendered app/pages/admin/secret.vue.