CVE-2026-71315

Nuxt is an open-source web development framework for Vue.js. From 3.21.7 until 3.21.10 and 4.5.1, mixed-case routeRules keys can fail to match case-folded lookups when router.options.sensitive is false and drop appMiddleware authorization gates. This is caused by an incomplete fix for...

NPM: Nuxt route rules silently dropped for mixed-case paths, bypassing appMiddleware auth gates (incomplete fix for CVE-2026-53721)

NPM: Nuxt route rules silently dropped for mixed-case paths, bypassing appMiddleware auth gates incomplete fix for CVE-2026-53721 vulnerability discovered by ? in WordPress Npm nuxt versions = 3.21.7, 3.21.10...

EUVD-2026-53645

Nuxt is an open-source web development framework for Vue.js. From 3.21.7 until 3.21.10 and 4.5.1, mixed-case routeRules keys can fail to match case-folded lookups when router.options.sensitive is false and drop appMiddleware authorization gates. This is caused by an incomplete fix for...

CVE-2026-71315 Nuxt route rules silently dropped for mixed-case paths, bypassing appMiddleware auth gates (incomplete fix for CVE-2026-53721)

Nuxt is an open-source web development framework for Vue.js. From 3.21.7 until 3.21.10 and 4.5.1, mixed-case routeRules keys can fail to match case-folded lookups when router.options.sensitive is false and drop appMiddleware authorization gates. This is caused by an incomplete fix for...

CVE-2026-71315

Nuxt.js vulnerability CVE-2026-71315 affects Nuxt framework versions 3.21.7–3.21.10 and 4.5.1. Affected component is the router routeRules logic: mixed-case keys can fail to match case-folded lookups when router.options.sensitive is false, causing appMiddleware authorization gates to be silently ...

GHSA-MM7M-92G8-7M47 Nuxt: Route-rule middleware bypass via case-sensitivity mismatch between vue-router and the routeRules matcher

Impact Nuxt looks up routeRules for the current navigation by calling getRouteRules path: to.path from the page-router plugin and the no-pages router plugin. The compiled routeRules matcher built on rou3 performs case-sensitive matching, while vue-router is configured with its default sensitive:...