Nuxt Web Development Framework Route Matching Vulnerability
CVE-2026-71315
8.2HIGH
What is CVE-2026-71315?
A vulnerability in the Nuxt web development framework allows mixed-case routeRules keys to potentially fail in matching case-folded lookups when 'router.options.sensitive' is set to false. This can lead to the bypassing of appMiddleware authorization gates, compromising security measures. The issue originated from an incomplete fix for a prior vulnerability and affects versions 3.21.7 through 3.21.10, as well as version 4.5.1. The problem is addressed in the latest updates, and users are encouraged to upgrade to mitigate related risks.
Affected Version(s)
nuxt >= 4.4.7, < 4.5.1 < 4.4.7, 4.5.1
nuxt >= 3.21.7, < 3.21.10 < 3.21.7, 3.21.10