Which versions of Nuxt are affected by CVE-2026-53721?

Nuxt framework versions 3.11.0-3.21.6 and 4.0.0-4.4.6 contain a high-severity vulnerability allowing attackers to bypass authentication and security controls by varying URL case; no public exploit…. A patch is available.

Is there a public PoC exploit available for CVE-2026-53721?

Yes, a public proof-of-concept exploit is available for CVE-2026-53721. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-53721?

24 hours: Audit production environment to identify all Nuxt 3 and 4 applications and their versions. 7 days: Implement URL case normalization at reverse proxy or load balancer layer; enable request logging for case-variant access to protected routes. 30 days: Monitor vendor security advisories for release of patched versions 3.21.7 and 4.4.7; develop and test upgrade plan.

Nuxt CVE-2026-53721

Q: What is the CVSS score of CVE-2026-53721?

CVE-2026-53721 has a CVSS 4.0 base score of 8.8 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-36427 HIGH

Improper Handling of Case Sensitivity (CWE-178)

2026-06-12 GitHub_M

GHSA-mm7m-92g8-7m47

Authentication Bypass Nuxt

8.8

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.8 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.2 HIGH

Remote unauthenticated case-flip bypass of routeRules middleware over HTTP yields AV:N/AC:L/PR:N/UI:N; primary impact is exposing gated content (C:H) with limited integrity effect from missed redirects/headers (I:L) and no availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jun 12, 2026 - 16:01 EUVD

Source Code Evidence Fetched

Jun 12, 2026 - 14:52 vuln.today

Analysis Generated

Jun 12, 2026 - 14:52 vuln.today

DescriptionCVE.org

Nuxt is an open-source web development framework for Vue.js. From versions 3.11.0 to before 3.21.7 and 4.0.0 to before 4.4.7, there is a route-rule middleware bypass via case-sensitivity mismatch between vue-router and the routeRules matcher. This issue has been patched in versions 3.21.7 and 4.4.7.

AnalysisAI

Route-rule middleware bypass in Nuxt 3.11.0-3.21.6 and 4.0.0-4.4.6 allows remote attackers to evade routeRules-defined protections (authentication, redirects, headers, prerender/SSR controls) by simply varying URL case, because vue-router matches paths case-insensitively while the routeRules matcher matched case-sensitively. The fix in 3.21.7 and 4.4.7 lowercases the path before matching. EPSS is 0.02% and no public exploit is identified at time of analysis, but the underlying class is trivially abused once an asymmetric rule is known.

Technical ContextAI

Nuxt is a Vue.js meta-framework that layers server routing and middleware (route rules) on top of vue-router via the Nitro server. routeRules let developers attach behaviour - auth gates, redirects, security headers, SSR/prerender mode, caching - to URL patterns. Vue-router resolves incoming paths case-insensitively by default, but Nuxt's internal routeRulesMatcher (in packages/nitro-server/src/index.ts and packages/nuxt/src/app/composables/manifest.ts) compared the raw path, so /Admin and /admin would route to the same component yet only the lowercase form would pick up the protective rule. This is a textbook CWE-178 (Improper Handling of Case Sensitivity) normalization gap between two routing layers; the patch (commits 07e39cd and 3f3e3fa) normalizes the path with toLowerCase() before invoking the matcher, and a new regression test asserts case-insensitive matching mirrors vue-router behavior.

RemediationAI

Vendor-released patch: upgrade to Nuxt 3.21.7 on the 3.x line or 4.4.7 on the 4.x line, per advisory GHSA-mm7m-92g8-7m47 (https://github.com/nuxt/nuxt/security/advisories/GHSA-mm7m-92g8-7m47); the fix normalizes the path with toLowerCase() before routeRules matching so it aligns with vue-router's case-insensitive routing. If you cannot upgrade immediately, mitigate by adding lowercase-equivalent entries for every security-relevant routeRule (e.g. duplicate '/Admin/' alongside '/admin/'), or place a reverse proxy / edge middleware in front of Nuxt that lowercases the request path before it reaches the app - note the proxy approach can break case-sensitive backends or signed URLs that depend on exact casing, and the duplicate-rules approach is brittle and easy to miss for new routes.