CVE-2026-71315: Nuxt.js Auth Bypass Vulnerability

CVE-2026-71315 Overview

CVE-2026-71315 is an authorization bypass vulnerability in Nuxt, an open-source web development framework for Vue.js. The flaw affects versions from 3.21.7 up to (but not including) 3.21.10, and version 4.5.0 prior to 4.5.1. Mixed-case routeRules keys fail to match case-folded lookups when router.options.sensitive is false. This inconsistency drops appMiddleware authorization gates, allowing unauthenticated requests to reach protected routes. The issue is an incomplete fix for CVE-2026-53721 and is tracked under [CWE-178: Improper Handling of Case Sensitivity].

Critical Impact
Attackers can bypass appMiddleware authorization on protected routes by requesting mixed-case URLs, gaining access to resources gated by routeRules keys such as /Admin.

Affected Products

Nuxt versions 3.21.7 through 3.21.9
Nuxt version 4.5.0
Applications relying on routeRules with appMiddleware for authorization

Discovery Timeline

2026-08-05 - CVE-2026-71315 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-71315

Vulnerability Analysis

Nuxt uses two routers with mismatched case-sensitivity semantics. The rou3 router matches keys case-sensitively, while vue-router matches routes case-insensitively unless router.options.sensitive is true. A routeRules entry keyed /Admin compiles into rou3 verbatim. When a request for /admin arrives, the manifest matcher case-folds the lookup path before consulting rou3, and the folded lookup fails to match the mixed-case key.

The compiled routeRulesMatcher in packages/nuxt/src/app/composables/manifest.ts invoked path.toLowerCase() before lookup. Any appMiddleware protection attached to a mixed-case key is silently skipped for case-varied requests. This defeats authorization gates without producing warnings or errors.

Root Cause

The fix for the earlier CVE-2026-53721 introduced case-folding on the lookup side but not on the key-registration side. Route rule keys remained verbatim in the router while lookups were forcibly lowercased. Any developer using /Admin, /API, or similar mixed-case keys lost protection whenever a client varied path casing.

Attack Vector

Exploitation requires no authentication and no user interaction. An attacker sends an HTTP request to a protected path with case altered from the configured routeRules key. For example, if /Admin has appMiddleware: 'auth', requesting /admin bypasses the middleware entirely while still resolving to the same underlying route in vue-router.

typescript

// Patch in packages/nuxt/src/app/composables/manifest.ts
export function getRouteRules (arg: string | H3Event | { path: string }) {
  const path = typeof arg === 'string' ? arg : arg.path
  try {
-    return routeRulesMatcher(path.toLowerCase())
+    // The compiled matcher case-folds the lookup path itself (unless routing is
+    // `sensitive`), so callers pass the path verbatim; folding here as well would
+    // force case-insensitive matching even when `sensitive: true` is configured.
+    return routeRulesMatcher(path)
  } catch (e) {
    console.error('[nuxt] Error matching route rules.', e)
    return {}

Source: GitHub Commit Fix

The server-side patch registers both a verbatim and a folded matcher, then selects at runtime based on router.options.sensitive:

typescript

// Patch in packages/nitro-server/src/index.ts
+  const caseSensitiveRouteRules = !!nuxt.options.router.options.sensitive
+  const foldRouteRuleKey = (route: string) => caseSensitiveRouteRules || typeof route !== 'string' ? route : route.toLowerCase()
+
+  function getRouteRulesRouter (fold: boolean) {
     const routeRulesRouter = createRou3Router<NitroRouteRules>()
     if (nuxt._nitro) {
+      const foldedKeys = new Map<string, string>()
       for (const [route, rules] of Object.entries(nuxt._nitro.options.routeRules)) {
         if (route === '/__nuxt_error') { continue }
         if (validManifestKeys.every(key => !(key in rules))) { continue }
+        const key = fold && typeof route === 'string' ? route.toLowerCase() : route
+        addRoute(routeRulesRouter, undefined, key, rules)
       }

Source: GitHub Commit Update

Detection Methods for CVE-2026-71315

Indicators of Compromise

HTTP access logs showing successful 2xx responses to protected paths where the request path casing differs from configured routeRules keys (for example, /admin reaching a /Admin route without authentication).
Absence of expected appMiddleware authentication events in server logs for requests to sensitive routes.
Requests to sensitive endpoints from clients that did not previously authenticate against /api/auth or equivalent flows.

Detection Strategies

Audit deployed Nuxt applications for routeRules keys containing uppercase characters and cross-reference them with the running version.
Add integration tests that request each protected route with varied path casing and assert that unauthorized requests receive 401 or 403 responses.
Instrument appMiddleware handlers to emit structured logs on each invocation, then alert when protected paths are reached without corresponding middleware log entries.

Monitoring Recommendations

Forward Nuxt server logs and web application firewall telemetry to a centralized SIEM for correlation across authentication events and route access.
Alert on repeated requests to sensitive paths that vary only by case, which suggests probing for the case-folding bypass.
Track deployed Nuxt versions in your software inventory and flag any host still running 3.21.7 through 3.21.9 or 4.5.0.

How to Mitigate CVE-2026-71315

Immediate Actions Required

Upgrade Nuxt to version 3.21.10 or 4.5.1, which contain the corrected case-folding logic.
Enumerate all routeRules entries and rewrite mixed-case keys to lowercase, or set router.options.sensitive: true and audit for exact-case matches.
Review access logs for the past 30 to 90 days for requests to sensitive routes using case-varied paths.

Patch Information

The Nuxt maintainers released fixes in v3.21.10 and v4.5.1. Technical details are documented in the GHSA-hxvh-4h3w-prp9 security advisory. The fix registers both verbatim and case-folded matchers in the Nitro server and removes the unconditional toLowerCase() in the client manifest matcher.

Workarounds

Normalize all routeRules keys to lowercase in nuxt.config.ts until the framework can be upgraded.
Set router.options.sensitive: true and ensure every routeRules key exactly matches the canonical path casing used by clients.
Enforce authorization inside route handlers or server middleware rather than relying solely on appMiddleware gates driven by routeRules.
Deploy a reverse-proxy or WAF rule that canonicalizes incoming paths to lowercase before they reach the Nuxt server.

bash

# Upgrade Nuxt to a patched release
npm install nuxt@3.21.10
# or for the 4.x line
npm install nuxt@4.5.1

# Verify the installed version
npx nuxt info | grep -i nuxt