CVE-2026-53721 Details

A route-rule middleware bypass vulnerability has been identified in Nuxt, an open-source web development framework for Vue.js. This issue affects Nuxt versions 3.11.0 prior to 3.21.7 and 4.0.0 prior to 4.4.7. The vulnerability arises from a case-sensitivity mismatch between vue-router and the routeRules matcher, leading to improper handling of route rules. As a result, middleware declared via routeRules may be skipped, creating potential authorization gaps.

Upgrade to Nuxt version 3.21.7 or 4.4.7, where this vulnerability has been patched. Alternatively, for applications that cannot be immediately upgraded, route-critical middleware can be moved off routeRules.appMiddleware and onto definePageMeta({ middleware: [...] }) on the protected page components.