CVE-2026-71315

Published: Aug 5, 2026Modified: Aug 6, 2026

8.2

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Exploitability: 3.9 / Impact: 4.2

Source: security-advisories@github.com (Secondary)

Description

Nuxt is an open-source web development framework for Vue.js. From 3.21.7 until 3.21.10 and 4.5.1, mixed-case routeRules keys can fail to match case-folded lookups when router.options.sensitive is false and drop appMiddleware authorization gates. This is caused by an incomplete fix for CVE-2026-53721. This issue is fixed in 3.21.10 and 4.5.1.

Related CWEs

Improper Handling of Case Sensitivity

The product does not properly account for differences in case sensitivity when accessing or determining the properties of a resource, leading to inconsistent results.

Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.

References (5)

https://github.com/nuxt/nuxt/commit/619963309e082190bac4a26b05f2dd155b039b81

Source: security-advisories@github.com

https://github.com/nuxt/nuxt/commit/ad624a75ad2d215f43633f6b40be346a7194d34d

Source: security-advisories@github.com

https://github.com/nuxt/nuxt/releases/tag/v3.21.10

Source: security-advisories@github.com

https://github.com/nuxt/nuxt/releases/tag/v4.5.1

Source: security-advisories@github.com

https://github.com/nuxt/nuxt/security/advisories/GHSA-hxvh-4h3w-prp9

Source: security-advisories@github.com

Timeline

No history available yet.