CVE-2026-71315

Name of the Vulnerable Software and Affected Versions Nuxt versions 3.21.7 through 3.21.9 Nuxt versions 4.5.0 and earlier

Description When router.options.sensitive is set to false, mixed-case routeRules keys may fail to match case-folded lookups. This occurs because the lookup path is converted to lowercase while the route-rule keys remain in their original casing. Consequently, pages with mixed-case keys—such as those derived from PascalCase or camelCase page files—render without their intended protections. This can lead to an authorization bypass where appMiddleware rules used as authentication gates are ignored, allowing unauthenticated visitors to access protected pages and server-side rendered data. This issue also affects client redirect middleware, the ssr: false decision, prerender, and payload handling. This flaw does not affect server-emitted headers, redirects, or proxies handled by Nitro.

Recommendations Update Nuxt to version 3.21.10. Update Nuxt to version 4.5.1. As a temporary workaround, define all routeRules and page filenames in lowercase. As a temporary workaround, set router: { options: { sensitive: true } } to enable case-sensitive routing and matching. As a temporary workaround, implement server-side protections, such as server middleware for authentication, that do not rely on route-rule matching.