AI description
CVE-2026-71315 describes a vulnerability within Nuxt, an open-source web development framework for Vue.js. This flaw affects versions 3.21.7 through 3.21.10 and 4.5.1. The issue arises when mixed-case `routeRules` keys fail to properly match case-folded lookups, specifically when the `router.options.sensitive` setting is configured as false. This improper handling of case sensitivity can lead to the bypass of `appMiddleware` authorization gates, potentially allowing unauthorized access. The vulnerability is considered an incomplete fix for a previous issue, CVE-2026-53721, and has been addressed in Nuxt versions 3.21.10 and 4.5.1. It is categorized under CWE-178 (Improper Handling of Case Sensitivity) and CWE-863 (Incorrect Authorization).
- Description
- Nuxt is an open-source web development framework for Vue.js. From 3.21.7 until 3.21.10 and 4.5.1, mixed-case routeRules keys can fail to match case-folded lookups when router.options.sensitive is false and drop appMiddleware authorization gates. This is caused by an incomplete fix for CVE-2026-53721. This issue is fixed in 3.21.10 and 4.5.1.
- Source
- security-advisories@github.com
- NVD status
- Deferred
CVSS 3.1
- Type
- Secondary
- Base score
- 8.2
- Impact score
- 4.2
- Exploitability score
- 3.9
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
- Severity
- HIGH
- security-advisories@github.com
- CWE-178
- Hype score
- Not currently trending
CVE-2026-71315, CVE-2026-53721 😔
@eren717_
6 Sept 2026
1791 Impressions
0 Retweets
12 Likes
3 Bookmarks
0 Replies
0 Quotes
🚨*CVE* CVE-2026-71315 Nuxt is an open-source web development framework for Vue.js. From 3.21.7 until 3.21.10 and 4.5.1, mixed-case routeRules keys can fail to match case-folded lookups whe… https://t.co/MKkcCWwtPE ----- Traducción: CVE-2026-71315 Nux… https://t.co/utmtNg
@infoflowcloud
6 Aug 2026
45 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes