{"id":"CVE-2026-71315","title":"Nuxt is an open-source web development framework for Vue.js","summary":"Nuxt is an open-source web development framework for Vue.js. From 3.21.7 until 3.21.10 and 4.5.1, mixed-case routeRules keys can fail to match case-folded lookups when router.options.sensitive is false and drop appMiddleware authorizatio…","severity":"high","cvss":8.2,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","cwe":["CWE-178","CWE-863"],"vendor":"nuxt","product":"nuxt","affected":["nuxt >= 4.4.7, < 4.5.1","nuxt >= 3.21.7, < 3.21.10"],"patched":["nuxt 4.5.1","nuxt 3.21.10"],"published":"2026-08-05","updated":"2026-09-08","sourceUpdated":"2026-09-08T20:51:43.490","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-71315","references":[{"url":"https://github.com/nuxt/nuxt/commit/619963309e082190bac4a26b05f2dd155b039b81","label":"security-advisories@github.com"},{"url":"https://github.com/nuxt/nuxt/commit/ad624a75ad2d215f43633f6b40be346a7194d34d","label":"security-advisories@github.com"},{"url":"https://github.com/nuxt/nuxt/releases/tag/v3.21.10","label":"security-advisories@github.com"},{"url":"https://github.com/nuxt/nuxt/releases/tag/v4.5.1","label":"security-advisories@github.com"},{"url":"https://github.com/nuxt/nuxt/security/advisories/GHSA-hxvh-4h3w-prp9","label":"security-advisories@github.com"},{"url":"https://github.com/advisories/GHSA-hxvh-4h3w-prp9"}],"tags":["nvd","ghsa","npm"],"epss":0.00267,"epssPercentile":0.19094,"aliases":["GHSA-hxvh-4h3w-prp9"],"ecosystem":"npm","ingestedAt":"2026-08-05T21:52:35.852Z","slug":"CVE-2026-71315","body":"## Overview\n\nNuxt is an open-source web development framework for Vue.js. From 3.21.7 until 3.21.10 and 4.5.1, mixed-case routeRules keys can fail to match case-folded lookups when router.options.sensitive is false and drop appMiddleware authorization gates. This is caused by an incomplete fix for CVE-2026-53721. This issue is fixed in 3.21.10 and 4.5.1.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-71315)\n\nAffected packages:\n\n- `nuxt >= 4.4.7, < 4.5.1`\n- `nuxt >= 3.21.7, < 3.21.10`\n\nPatched in:\n\n- `nuxt 4.5.1`\n- `nuxt 3.21.10`\n\nSource: https://github.com/advisories/GHSA-hxvh-4h3w-prp9","depth":"twilight","depthScore":45,"depthScoreParts":{"impact":45.1,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}