Nuxt CVE-2026-53721

The target application must be a Nuxt app on 3.11.0-3.21.6 or 4.0.0-4.4.6 that defines at least one routeRules entry whose security effect (authentication gate, redirect, security headers, or restricted prerender/SSR behavior) the attacker wants to evade, and the rule's path pattern must contain at least one character whose case can be flipped while still being routed by vue-router to the same handler. Exploitation requires no authentication, no user interaction, and no non-default configuration beyond using the routeRules feature itself; it is limited only by whether routeRules are actually used for security-relevant purposes (apps using routeRules only for caching/SSR tuning gain little for an attacker) and by any upstream proxy/CDN that already normalizes path casing before the request reaches Nuxt.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L) rates this 8.8 High, treating it as a fully remote, unauthenticated bypass with high confidentiality impact, which is consistent with how routeRules are commonly used to gate sensitive areas. However EPSS sits at 0.02% (7th percentile) and the issue is not on CISA KEV, indicating no observed mass exploitation; real-world risk is highly dependent on whether a given Nuxt app actually uses routeRules for security (auth/redirect/header rules) rather than for performance/SSR only - apps that rely on routeRules purely for prerender or caching see little security impact. Exploitation is trivial once an asymmetric rule is known (case-flip the URL), so prioritize patching any application that uses routeRules for access control, redirects, or security headers; deprioritize where routeRules only configure rendering modes.

An attacker browsing a Nuxt-built site notices that /admin returns a login challenge defined by a routeRule, then requests /Admin or /ADMIN; vue-router resolves it to the same admin page component while the routeRules matcher fails to apply the auth/redirect/header rule, granting unauthenticated access to the protected view or revealing prerendered/SSR-only content. No special tooling is required - a browser address-bar edit or curl with a case-shifted path suffices - and no public weaponized exploit is identified at time of analysis.