CVE-2026-71315: 
Nuxt Analyse et atténuation des vulnérabilités

CVE-2026-71315 is an authorization bypass vulnerability in the Nuxt web framework (Vue.js) caused by improper handling of case sensitivity in route rule matching. It affects Nuxt versions >= 3.21.7 and < 3.21.10 (3.x branch) and >= 4.4.7 and < 4.5.1 (4.x branch). The vulnerability is an incomplete fix for a prior advisory (CVE-2026-53721 / GHSA-mm7m-92g8-7m47): the earlier fix lowercased the lookup path during route rule matching but left the compiled route-rule keys in their original mixed case, causing them to never match. It was disclosed on August 5, 2026, with patches released the same day. The CVSS v3.1 base score is 8.2 (High) (GitHub Advisory).

The root cause is classified under CWE-178 (Improper Handling of Case Sensitivity) and CWE-863 (Incorrect Authorization). When router.options.sensitive is false (the default), Nuxt's route-rule matcher lowercases the incoming request path before lookup, but the route-rule keys compiled into the matcher retain their original casing (e.g., /Admin/dashboard). Because the lookup path is folded to lowercase while the key remains mixed-case, the matcher never finds a match, silently dropping all app-level route-rule protections — including appMiddleware auth gates, appLayout, client redirect middleware, and the app-side ssr decision. Vue-router still serves the page case-insensitively, so the page renders without any of its intended Nuxt protections. The fix (commits 6199633 and ad624a7) case-folds the compiled route-rule keys symmetrically with the lookup path, and emits both a verbatim and a folded matcher selected at runtime based on the sensitive setting (GitHub Advisory, Fix Commit 3.x, Fix Commit 4.x).

An unauthenticated remote attacker can bypass authentication middleware defined via routeRules by accessing protected pages using any case variation of the URL (e.g., /Admin/dashboard, /admin/dashboard, or /ADMIN/dashboard). This allows unauthorized viewing of protected pages and their server-side rendered (SSR) data without being redirected to login. Beyond auth bypass, the same gap silently drops other app-level route-rule behaviors for mixed-case keys, including client redirect middleware, the app-side ssr: false decision, prerender, and payload handling, potentially exposing sensitive SSR-fetched data to unauthenticated visitors (GitHub Advisory).

1. Reconnaissance: Identify Nuxt-powered web applications (e.g., via HTTP response headers such as x-powered-by: Nuxt or JavaScript bundle analysis) running versions 3.21.7–3.21.9 or 4.4.7–4.5.0.
2. Identify protected routes: Browse the application to discover pages that appear to require authentication or redirect to a login page (e.g., /admin/dashboard, /Admin/Settings).
3. Probe for mixed-case route rules: Attempt to access the protected route using alternate case variations — e.g., /Admin/Dashboard, /ADMIN/DASHBOARD, or /Admin/dashboard — directly in the browser or via a tool like curl.
4. Bypass auth gate: If the application uses mixed-case routeRules keys (common when page files use PascalCase naming, e.g., pages/Admin.vue), the appMiddleware auth gate is silently dropped and the page renders with its full SSR-fetched data to the unauthenticated requester.
5. Exfiltrate data: Extract sensitive information from the rendered page or its associated _payload.json endpoint, which may contain SSR-fetched API data returned without authentication checks (GitHub Advisory).

• Network: HTTP requests to protected routes using mixed-case URL variations (e.g., /Admin/Dashboard, /ADMIN/DASHBOARD) that return HTTP 200 responses instead of 302 redirects to a login page; requests to /_payload.json endpoints for protected routes without a prior authenticated session.
• Logs: Web server or Nuxt access logs showing successful (200 OK) responses to mixed-case variants of routes that should redirect unauthenticated users; absence of expected redirect (302) responses for those paths.
• Application Behavior: Protected pages rendering SSR content (including sensitive data) to sessions with no authentication cookies or tokens present.

Upgrade to nuxt@3.21.10 (3.x) or nuxt@4.5.1 (4.x) as soon as possible using npx nuxt upgrade --dedupe. If an immediate upgrade is not possible, apply one of the following workarounds: (1) rename all page files and routeRules keys to use only lowercase characters so they already match the folded lookup path; (2) set router: { options: { sensitive: true } } to make routing and route-rule matching both case-sensitive (note: requests must then use the exact configured casing); or (3) enforce authentication server-side via a Nitro server middleware independent of route rules, which is not affected by the case-folding issue (GitHub Advisory, v3.21.10 Release, v4.5.1 Release).

The Nuxt maintainer Daniel Roe published the advisory and released patches on July 27, 2026, describing it as a security release and recommending immediate upgrade. The release notes for both v3.21.10 and v4.5.1 explicitly note that users who had already upgraded for the prior CVE-2026-53721 advisory still need this release, as it addresses a regression introduced by that earlier fix. The advisory was picked up by automated vulnerability tracking services including VulDB, OSV, and CIRCL shortly after publication (v3.21.10 Release, v4.5.1 Release, GitHub Advisory).