HIGH 8.2 GitHub
CVE-2026-71315
Nuxt route rules silently dropped for mixed-case paths, bypassing appMiddleware auth gates (incomplete fix for CVE-2026-53721)
### Impact
Nuxt matches route rules case-insensitively by default (mirroring vue-router's default `sensitive: false` routing). The fix for GHSA-mm7m-92g8-7m47 / CVE-2026-53721 lowercased the *lookup* path before matching route rules, but the route-rule *keys* compiled into the matcher were left verbatim. As a result, any route rule whose key contains an uppercase character (for example `/Admin`, `/Dashboard/**`, or the rules Nuxt derives from PascalCase/camelCase page files such as `pages/Admin
Affected Products
- npm/nuxt >= 4.4.7, < 4.5.1
- npm/nuxt >= 3.21.7, < 3.21.10
References
- https://github.com/advisories/GHSA-hxvh-4h3w-prp9
- https://github.com/nuxt/nuxt/security/advisories/GHSA-hxvh-4h3w-prp9
- https://github.com/nuxt/nuxt/commit/619963309e082190bac4a26b05f2dd155b039b81
- https://github.com/nuxt/nuxt/commit/ad624a75ad2d215f43633f6b40be346a7194d34d
This high severity vulnerability with a CVSS score of 8.2 was published on 2026-08-05 via GitHub. Affected: npm/nuxt >= 4.4.7, < 4.5.1, npm/nuxt >= 3.21.7, < 3.21.10.
vulnfeed aggregates 9344 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.