What is the CVSS score of CVE-2026-71315?

CVE-2026-71315 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.3%.

Which versions of Nuxt are affected by CVE-2026-71315?

Nuxt versions 3.21.7-3.21.9 and 4.4.7-4.5.0 contain an authorization bypass allowing unauthenticated users to access routes protected by application middleware when route configurations use…. A patch is available.

Is there a public PoC exploit available for CVE-2026-71315?

Yes, a public proof-of-concept exploit is available for CVE-2026-71315. Prioritise patching immediately. EPSS: 0.3%.

How to fix or mitigate CVE-2026-71315?

Within 24 hours: inventory all Nuxt deployments to identify affected versions (3.21.7-3.21.9 and 4.4.7-4.5.0); audit routeRules configurations and page directory structures for mixed-case naming patterns to determine exposure scope. Within 7 days: implement interim mitigations by converting all route-rule keys and PascalCase page files to lowercase (e.g., pages/Admin.vue to pages/admin.vue), or deploy additional application-level authentication middleware independent of Nuxt routeRules; implement WAF rules restricting access to sensitive routes. Within 30 days: monitor Nuxt security advisories for patch availability; validate patch in non-production environment; plan and execute urgent production upgrades to patched versions when released, prioritizing systems handling sensitive data.

Nuxt CVE-2026-71315

EUVD-2026-53645 HIGH

Improper Handling of Case Sensitivity (CWE-178)

2026-08-05 security-advisories@github.com

GHSA-hxvh-4h3w-prp9

Information Disclosure

8.2

CVSS 3.1 · Vendor: github

Severity by source

Vendor (github) PRIMARY

8.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

vuln.today AI

8.2 HIGH

Network-accessible auth bypass with no privileges or interaction needed; C:H for SSR data exposure, I:L for incidental write access on protected pages, A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (github).

CVSS VectorVendor: github

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Patch available

Aug 05, 2026 - 22:02 EUVD

Source Code Evidence Fetched

Aug 05, 2026 - 21:33 vuln.today

Analysis Generated

Aug 05, 2026 - 21:33 vuln.today

CVE Published

Aug 05, 2026 - 21:16 cve.org

HIGH 8.2

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

2 npm packages depend on nuxt (2 direct, 0 indirect)

Ecosystem-wide dependent count for version 4.4.7.

DescriptionCVE.org

Nuxt is an open-source web development framework for Vue.js. From 3.21.7 until 3.21.10 and 4.5.1, mixed-case routeRules keys can fail to match case-folded lookups when router.options.sensitive is false and drop appMiddleware authorization gates. This is caused by an incomplete fix for CVE-2026-53721. This issue is fixed in 3.21.10 and 4.5.1.

AnalysisAI

Authorization gate bypass in Nuxt (npm package, versions 3.21.7-<3.21.10 and 4.4.7-<4.5.1) allows unauthenticated network access to routes protected by appMiddleware auth rules whenever those route-rule keys contain uppercase characters. This is an incomplete fix for CVE-2026-53721: the prior patch case-folded the lookup path before matching route rules, but left the compiled rule keys verbatim, producing a permanent symmetric mismatch that silently drops all app-level protections for any mixed-case route. No public exploit has been identified at time of analysis; however, the vulnerable condition arises automatically in any Nuxt application deriving route rules from PascalCase page files (e.g., pages/Admin.vue) or writing mixed-case routeRules keys explicitly.

Technical ContextAI

CWE-178 (Improper Handling of Case Sensitivity) describes the root cause precisely. Nuxt's app-level route-rule matcher is built on rou3, which stores and matches route keys case-sensitively. Vue-router - and by extension Nuxt - matches page routes case-insensitively by default (router.options.sensitive defaults to false). The fix for CVE-2026-53721 / GHSA-mm7m-92g8-7m47 addressed this mismatch by lowercasing the lookup path before passing it to the rou3 matcher, but neglected to also lowercase the route-rule keys at compile time. The result is that a rule keyed '/Admin' is stored verbatim in the compiled matcher, while every runtime lookup arrives as '/admin' - the two can never match. The diff in packages/nitro-server/src/index.ts introduces a foldRouteRuleKey helper that lowercases keys at build time (when caseSensitiveRouteRules is false), and emits both a verbatim and a folded matcher, selecting between them at runtime based on routerOptions.sensitive. The CPE-identified package is npm/nuxt; affected ranges are >=3.21.7 <3.21.10 and >=4.4.7 <4.5.1. Only Nuxt's own app-level route-rule subsystem is affected - Nitro's server-side matcher (used for per-route headers, server redirect, and proxy rules) uses its own case-sensitive logic and is explicitly out of scope per the GHSA advisory.

RemediationAI

The primary fix is to upgrade to nuxt@3.21.10 (3.x branch) or nuxt@4.5.1 (4.x branch), both available on npm and confirmed by GitHub release tags at https://github.com/nuxt/nuxt/releases/tag/v3.21.10 and https://github.com/nuxt/nuxt/releases/tag/v4.5.1. The patches implement symmetric case-folding at both compile time (route-rule keys) and runtime (lookup path), gated on router.options.sensitive. Three workarounds are available for deployments that cannot upgrade immediately. First, rewrite all routeRules keys to lowercase and rename any PascalCase page files to lowercase equivalents - this ensures keys already match the folded lookup path, with no change to routing behavior but requiring ongoing discipline to maintain. Second, set router: { options: { sensitive: true } } in nuxt.config - this disables case-folding on both sides, but requires that all client requests use exact casing matching the page file names, which can break bookmarked or user-typed URLs. Third, enforce authentication via a Nitro server middleware (server/middleware/auth.ts) rather than appMiddleware route rules - this moves the auth gate to the server side, which is unaffected by this vulnerability, but requires duplicating or restructuring authorization logic outside Nuxt's app-layer convention. The GHSA advisory at https://github.com/nuxt/nuxt/security/advisories/GHSA-hxvh-4h3w-prp9 confirms all three workarounds.