npm: Nuxt: Server-side route rules (`redirect`, `headers`, `proxy`, `ssr`) are skipped for case-variant paths when routing is case-insensitive

npm: Nuxt: Server-side route rules redirect, headers, proxy, ssr are skipped for case-variant paths when routing is case-insensitive vulnerability discovered by ? in WordPress npm nuxt versions = 3.0.0, 4.0.0...

CVE-2026-114132

The Nuxt web development framework is vulnerable prior to version 4.6.2 due to a discrepancy in how it handles case sensitivity. While Nuxt resolves pages case-insensitively by default, the Nitro engine matches server-side route-rule keys case-sensitively. This allows requests with paths differin...

CVE-2026-114132 Nuxt: Server-side route rules (`redirect`, `headers`, `proxy`, `ssr`) are skipped for case-variant paths when routing is case-insensitive

Nuxt is an open-source web development framework for Vue.js. Prior to 4.6.2, Nuxt resolves pages case-insensitively by default while Nitro matches server-side route-rule keys case-sensitively, allowing a request whose path differs only by letter case to render without the server rule intended for...

CVE-2026-114132 Nuxt: Server-side route rules (`redirect`, `headers`, `proxy`, `ssr`) are skipped for case-variant paths when routing is case-insensitive

Nuxt is an open-source web development framework for Vue.js. Prior to 4.6.2, Nuxt resolves pages case-insensitively by default while Nitro matches server-side route-rule keys case-sensitively, allowing a request whose path differs only by letter case to render without the server rule intended for...

CVE-2026-114131 Nuxt: Route rules are matched against the raw request path, so a percent-encoded segment can bypass `appMiddleware` on dynamic and catch-all routes

Nuxt is an open-source web development framework for Vue.js. From 3.11.0 until 3.21.4 and 4.4.4, Nuxt compares route-rule keys with the raw request path while route resolution decodes dynamic and catch-all parameters, allowing a percent-encoded segment to resolve to a protected page without...

CVE-2026-114131

The Nuxt web development framework (versions 3.11.0 up to 3.21.4 and 4.4.4) is vulnerable to a security bypass due to an interpretation conflict . The framework compares route-rule keys against the raw request path while decoding dynamic and catch-all parameters during route resolution. An attack...

Nuxt route rules silently dropped for mixed-case paths, bypassing appMiddleware auth gates (incomplete fix for CVE-2026-53721)

Impact Nuxt matches route rules case-insensitively by default mirroring vue-router's default sensitive: false routing. The fix for GHSA-mm7m-92g8-7m47 / CVE-2026-53721 lowercased the lookup path before matching route rules, but the route-rule keys compiled into the matcher were left verbatim. As ...

GHSA-HXVH-4H3W-PRP9 Nuxt route rules silently dropped for mixed-case paths, bypassing appMiddleware auth gates (incomplete fix for CVE-2026-53721)

Impact Nuxt matches route rules case-insensitively by default mirroring vue-router's default sensitive: false routing. The fix for GHSA-mm7m-92g8-7m47 / CVE-2026-53721 lowercased the lookup path before matching route rules, but the route-rule keys compiled into the matcher were left verbatim. As ...

CVE-2026-71315 Nuxt route rules silently dropped for mixed-case paths, bypassing appMiddleware auth gates (incomplete fix for CVE-2026-53721)

Nuxt is an open-source web development framework for Vue.js. From 3.21.7 until 3.21.10 and 4.5.1, mixed-case routeRules keys can fail to match case-folded lookups when router.options.sensitive is false and drop appMiddleware authorization gates. This is caused by an incomplete fix for...

EUVD-2026-53645

Nuxt is an open-source web development framework for Vue.js. From 3.21.7 until 3.21.10 and 4.5.1, mixed-case routeRules keys can fail to match case-folded lookups when router.options.sensitive is false and drop appMiddleware authorization gates. This is caused by an incomplete fix for...

CVE-2026-71315

Nuxt is an open-source web development framework for Vue.js. From 3.21.7 until 3.21.10 and 4.5.1, mixed-case routeRules keys can fail to match case-folded lookups when router.options.sensitive is false and drop appMiddleware authorization gates. This is caused by an incomplete fix for...

CVE-2026-71315

Nuxt.js vulnerability CVE-2026-71315 affects Nuxt framework versions 3.21.7–3.21.10 and 4.5.1. Affected component is the router routeRules logic: mixed-case keys can fail to match case-folded lookups when router.options.sensitive is false, causing appMiddleware authorization gates to be silently ...

CVE-2026-71315 Nuxt route rules silently dropped for mixed-case paths, bypassing appMiddleware auth gates (incomplete fix for CVE-2026-53721)

Nuxt is an open-source web development framework for Vue.js. From 3.21.7 until 3.21.10 and 4.5.1, mixed-case routeRules keys can fail to match case-folded lookups when router.options.sensitive is false and drop appMiddleware authorization gates. This is caused by an incomplete fix for...

CVE-2026-71315 Nuxt route rules silently dropped for mixed-case paths, bypassing appMiddleware auth gates (incomplete fix for CVE-2026-53721)

Nuxt is an open-source web development framework for Vue.js. From 3.21.7 until 3.21.10 and 4.5.1, mixed-case routeRules keys can fail to match case-folded lookups when router.options.sensitive is false and drop appMiddleware authorization gates. This is caused by an incomplete fix for...

EUVD-2026-38577

Traefik is an HTTP reverse proxy and load balancer. Prior to 3.6.21 and 3.7.5, there is a high severity vulnerability in Traefik's Kubernetes Gateway provider affecting the crossProviderNamespaces allowlist. For HTTPRoute rules that declare multiple WRR backendRefs, Traefik evaluates the allowlis...

GHSA-MM7M-92G8-7M47 Nuxt: Route-rule middleware bypass via case-sensitivity mismatch between vue-router and the routeRules matcher

Impact Nuxt looks up routeRules for the current navigation by calling getRouteRules path: to.path from the page-router plugin and the no-pages router plugin. The compiled routeRules matcher built on rou3 performs case-sensitive matching, while vue-router is configured with its default sensitive:...

NPM: Nuxt: Route-rule middleware bypass via case-sensitivity mismatch between vue-router and the routeRules matcher

NPM: Nuxt: Route-rule middleware bypass via case-sensitivity mismatch between vue-router and the routeRules matcher vulnerability discovered by ? in WordPress Npm nuxt versions = 3.11.0, 3.21.7...

Nuxt: Route-rule middleware bypass via case-sensitivity mismatch between vue-router and the routeRules matcher

Impact Nuxt looks up routeRules for the current navigation by calling getRouteRules path: to.path from the page-router plugin and the no-pages router plugin. The compiled routeRules matcher built on rou3 performs case-sensitive matching, while vue-router is configured with its default sensitive:...

CVE-2026-53721

Nuxt is an open-source web development framework for Vue.js. From versions 3.11.0 to before 3.21.7 and 4.0.0 to before 4.4.7, there is a route-rule middleware bypass via case-sensitivity mismatch between vue-router and the routeRules matcher. This issue has been patched in versions 3.21.7 and 4.4...

Improper Handling of Case Sensitivity

Overview Affected versions of this package are vulnerable to Improper Handling of Case Sensitivity through the getRouteRules function in the route rules matcher. An attacker can evade prerender, SSR, or redirect rules by sending a request with a path that uses different letter casing from the...