CVE-2026-53721

Name of the Vulnerable Software and Affected Versions Nuxt versions 3.11.0 through 3.21.6 Nuxt versions 4.0.0 through 4.4.6

Description A route-rule middleware bypass exists due to a case-sensitivity mismatch between vue-router and the routeRules matcher. While vue-router matches paths case-insensitively by default, the routeRules matcher performs case-sensitive matching. This discrepancy allows an attacker to bypass appMiddleware declared via routeRules by altering the case of static segments in a protected URL (e.g., using /Admin/dashboard instead of /admin/dashboard). Consequently, the protected page may be rendered without the middleware executing on both server-side rendering (SSR) and client navigations. This issue also affects other path-keyed route rules such as ssr, redirect, appLayout, and prerender or payload hints.

Recommendations Update Nuxt to version 3.21.7. Update Nuxt to version 4.4.7. Set router.options.sensitive = true to enable case-sensitive matching in vue-router. Move security-critical middleware from routeRules.appMiddleware to definePageMeta({ middleware: [...] }) within protected page components. Enforce authorization at the API or data-fetching layer.