The intent of the 404 is so that anonymous users with no permissions to a repository that exists inside of NXRM can learn of its existence, and then perhaps attempt to perform some other exploit against it.
We will review this issue again internally, but if you can explain why returning 404 when anonymous access is disabled is causing a problem, that would help us decide if we have cause to change this.
I’m having this same issue on OSS 3.24.0-02, including using the latest Docker image and we’re not attempting to use NXRM3 in any way, yet this error is cropping up and causing our Nexus server to go offline for circa 10 minutes at a time.
2020-06-09 17:38:55,019+0000 WARN [qtp22457663-656] *UNKNOWN org.sonatype.nexus.siesta.internal.WebappExceptionMapper - (ID 915b162b-d3c9-4fa1-8f04-109b2534a5a6) Response: [404] (no entity/body); mapped from: javax.ws.rs.WebApplicationException: Path not found