Vulnerability · Published Aug 5, 2026 · Assigned by GitHub_M

CVE-2026-71315Nuxt route rules silently dropped for mixed-case paths, bypassing appMiddleware auth gates (incomplete fix for CVE-2026-53721)

High 8.2

In plain English

A high-severity incorrect authorization in nuxt from nuxt. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.2High

Exploit odds (30 days)0.5%top 59.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Nuxt is an open-source web development framework for Vue.js. From 3.21.7 until 3.21.10 and 4.5.1, mixed-case routeRules keys can fail to match case-folded lookups when router.options.sensitive is false and drop appMiddleware authorization gates. This is caused by an incomplete fix for CVE-2026-53721. This issue is fixed in 3.21.10 and 4.5.1.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	nuxt	4.5.1	GHSA-hxvh-4h3w-prp9
npm	nuxt	3.21.10	GHSA-hxvh-4h3w-prp9

Affected products (as reported)

Vendor	Product	Versions
nuxt	nuxt	>= 4.4.7, < 4.5.1>= 3.21.7, < 3.21.10

Weakness: CWE-178, CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

References

https://github.com/nuxt/nuxt/security/advisories/GHSA-hxvh-4h3w-prp9 x_refsource_CONFIRM
https://github.com/nuxt/nuxt/commit/619963309e082190bac4a26b05f2dd155b039b81 x_refsource_MISC
https://github.com/nuxt/nuxt/commit/ad624a75ad2d215f43633f6b40be346a7194d34d x_refsource_MISC
https://github.com/nuxt/nuxt/releases/tag/v3.21.10 x_refsource_MISC
https://github.com/nuxt/nuxt/releases/tag/v4.5.1 x_refsource_MISC