CVE-2026-71315 Details
Description
Nuxt is an open-source web development framework for Vue.js. From 3.21.7 until 3.21.10 and 4.5.1, mixed-case routeRules keys can fail to match case-folded lookups when router.options.sensitive is false and drop appMiddleware authorization gates. This is caused by an incomplete fix for CVE-2026-53721. This issue is fixed in 3.21.10 and 4.5.1.
A vulnerability in Nuxt's route rule handling can lead to an authorization bypass. This issue affects Nuxt versions 3.21.7 prior to 3.21.10 and 4.4.7 prior to 4.5.1. The vulnerability arises because route rules are matched case-insensitively by default, while mixed-case keys are not properly normalized. As a result, route rules keyed with uppercase characters may not match as intended, dropping associated authorization middleware. This issue was introduced by an incomplete fix for a previous vulnerability and can be exploited by accessing routes with mixed-case paths, bypassing authentication requirements.
Upgrade to Nuxt versions 3.21.10 or 4.5.1, where this vulnerability has been fixed. If an immediate upgrade is not possible, route rules can be keyed in lowercase to match the default case-folded lookups, or the router can be configured for case-sensitive matching.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Aug 5, 2026CISA-ADP
Assessed Aug 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/nuxt/nuxt/commit/619963309e082190bac4a26b05f2dd155b039b81 | [email protected] | Source CodeVendor |
| https://github.com/nuxt/nuxt/commit/ad624a75ad2d215f43633f6b40be346a7194d34d | [email protected] | Source CodeVendor |
| https://github.com/nuxt/nuxt/releases/tag/v3.21.10 | [email protected] | Release NotesVendor |
| https://github.com/nuxt/nuxt/releases/tag/v4.5.1 | [email protected] | Release NotesVendor |
| https://github.com/nuxt/nuxt/security/advisories/GHSA-hxvh-4h3w-prp9 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-178 | Improper Handling of Case Sensitivity | [email protected] |
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Nuxt | >= 3.21.7, < 3.21.10 (semver) >= 4.4.7, < 4.5.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 6, 2026 | CVE Modified | CISA-ADP |
| Aug 5, 2026 | New CVE Received | [email protected] |