CVE-2026-71315 in Nuxt
Summary
by MITRE • 08/06/2026
Nuxt is an open-source web development framework for Vue.js. From 3.21.7 until 3.21.10 and 4.5.1, mixed-case routeRules keys can fail to match case-folded lookups when router.options.sensitive is false and drop appMiddleware authorization gates. This is caused by an incomplete fix for CVE-2026-53721. This issue is fixed in 3.21.10 and 4.5.1.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/06/2026
This vulnerability affects the Nuxt web development framework version 3.21.7 through 3.21.10 and 4.5.1, where routeRules keys with mixed case fail to match properly when router.options.sensitive is set to false. The flaw represents a regression in security controls that was initially addressed in CVE-2026-53721 but not completely resolved. When sensitive routing is disabled, the framework should perform case-insensitive lookups for route rules, but mixed-case keys are not properly handled leading to authorization failures.
The technical implementation issue stems from how Nuxt processes route matching when case insensitivity is enabled. The framework maintains a mapping of route rules that should be accessible regardless of case when router.options.sensitive is false, but the current implementation fails to normalize mixed-case keys during lookup operations. This creates a mismatch between expected behavior and actual execution where route rules defined with uppercase or mixed-case characters are not found during runtime processing.
The operational impact of this vulnerability is significant as it can bypass application middleware authorization gates that rely on route-based access controls. When routeRules keys do not match properly, legitimate requests may be denied access to protected routes while potentially malicious requests could exploit the inconsistent behavior. This creates a potential attack surface where an attacker might manipulate request routing to access unauthorized resources or bypass security controls entirely. The vulnerability specifically targets applications that depend on case-insensitive routing and middleware authorization enforcement.
This issue aligns with CWE-284 Access Control Bypass, as it allows unauthorized access through improper route matching mechanisms, and relates to ATT&CK technique T1078 Valid Accounts where compromised applications might be used to bypass application-level controls. The vulnerability also demonstrates weaknesses in input validation and case handling within web frameworks, particularly concerning routing and middleware processing. Organizations using Nuxt framework versions between 3.21.7 and 3.21.10 and 4.5.1 should immediately upgrade to the patched versions to prevent potential exploitation of this authorization bypass mechanism.
The fix implemented in versions 3.21.10 and 4.5.1 addresses the incomplete normalization of routeRules keys during case-insensitive lookups. The resolution ensures that when router.options.sensitive is false, all routeRule keys are properly converted to a consistent case format before matching operations occur. This prevents the scenario where mixed-case keys fail to match expected patterns while maintaining backward compatibility with existing applications. Security teams should verify their Nuxt application configurations and ensure that router.options.sensitive settings are properly evaluated against their security requirements.
This vulnerability demonstrates the complexity of implementing proper case-insensitive routing in web frameworks and highlights the importance of thorough regression testing when addressing security patches. The incomplete fix for CVE-2026-53721 shows how security improvements can introduce new edge cases that require careful validation. Organizations should conduct security reviews of their Nuxt applications to identify any custom route handling or middleware implementations that might be affected by this change, particularly those relying on mixed-case route definitions. The corrected implementation ensures consistent behavior across different case scenarios while maintaining the intended security posture of case-insensitive routing.