CVE-2026-71315: Nuxt Route Rules Case Sensitivity Vulnerability Leading to Authorization Bypass
Summary
CVE-2026-71315: Impact Nuxt matches route rules case-insensitively by default (mirroring vue-router's default sensitive: false routing). Affects nuxt across 2 version ranges.
>= 3.21.7, < 3.21.10
>= 4.4.7, < 4.5.1
Fixed in 3.21.10 or 4.5.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Nuxt is a popular framework built on Vue.js that enables developers to create server-rendered applications with ease. It provides features such as automatic routing, server-side rendering, and a powerful plugin system. However, Nuxt's default behavior of case-insensitive route matching can lead to vulnerabilities if not properly managed, particularly in scenarios involving authorization and middleware protections.
Vulnerability Detail
The vulnerability arises from Nuxt's handling of route rules, which are matched case-insensitively by default. While a previous fix attempted to address this issue by lowercasing the lookup path, it failed to account for the mixed-case keys of route rules. As a result, route rules with uppercase characters do not match, leading to potential authorization bypasses. For instance, an appMiddleware rule intended to protect certain routes can be circumvented, allowing unauthorized users to access restricted pages. This flaw compromises the security of the application, exposing sensitive data and functionalities to unauthenticated visitors.
How To Fix
Latest published version: 4.6.2 as of 22 Oct 2026
npm install nuxt@4.6.2Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 3.21.7, < 3.21.103.21.10npm install nuxt@3.21.10 -
>= 4.4.7, < 4.5.14.5.1npm install nuxt@4.5.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate upgrading is not possible, consider the following workarounds:
- Key all routeRules and name your page files in lowercase to match the folded lookup path.
- Configure the router to be case-sensitive by adding the following to your nuxt.config.js: router: { options: { sensitive: true } }
- Implement server-side middleware that checks authorization independently of route rules.
Conclusion
In summary, the vulnerability CVE-2026-71315 in Nuxt allows for case-insensitive route matching that can lead to authorization bypasses. It is crucial for developers to update to the latest patched versions or implement workarounds to secure their applications against unauthorized access.
See every vulnerability recorded for nuxt →
FAQ
The CVSS score of this vulnerability is 8.2, indicating a high severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected without needing to sign up.
The main consequence is an authorization bypass, allowing unauthorized users to access protected pages and their data.
Yes, you can implement workarounds such as using lowercase keys for routeRules or enforcing case-sensitive routing.
The patched versions are nuxt@4.5.1 for the 4.x series and nuxt@3.21.10 for the 3.x series.
References
Related vulnerabilities
Recent vulnerabilities recorded for nuxt.
