high · 8.2CVE-2026-71315Aug 5, 2026

CVE-2026-71315: Nuxt appMiddleware Auth Bypass via Mixed-Case Route Rule Keys

Rohit Hatagale
AI Security Researcher, SecureLayer7

Nuxt apps that protect pages with appMiddleware via routeRules are left completely unguarded if any route rule key contains an uppercase letter, because an incomplete earlier fix lowercased only the…

Packagenuxt
Ecosystemnpm
Affected>= 4.4.7, < 4.5.1
Fixed in4.5.1
CVE-2026-71315: Nuxt appMiddleware Auth Bypass via Mixed-Case Route Rule Keys

The problem

The fix for CVE-2026-53721 lowercased the navigation path before querying the routeRules matcher, but never lowercased the compiled rule keys. A key like '/Admin/dashboard' stays mixed-case in the matcher while every lookup arrives as '/admin/dashboard', so the two never align and the rule silently drops.

Because vue-router's default sensitive: false routing still serves the page for any casing variant, an unauthenticated visitor can reach the protected route and receive its fully SSR-rendered page, including any server-fetched data, with no middleware ever running.

The gap affects appMiddleware, appLayout, the client redirect middleware, the app-side ssr decision, prerender, and payload handling.

Proof of concept

A working proof-of-concept for CVE-2026-71315 in nuxt, with the exact payload below.

http
# nuxt.config.ts has:
# routeRules: { '/Admin/dashboard': { appMiddleware: 'auth' } }
#
# Any of these reach the page WITHOUT the auth middleware running:
GET /Admin/dashboard HTTP/1.1
Host: target.example.com

GET /admin/dashboard HTTP/1.1
Host: target.example.com

GET /ADMIN/DASHBOARD HTTP/1.1
Host: target.example.com

The root asymmetry is in the route-rule matcher build step. Commit 3f3e3fa (CVE-2026-53721 fix) added path.toLowerCase() only at lookup time. The keys fed into the rou3-based matcher at build time were never folded, so a PascalCase key like '/Admin' compiled verbatim.

Every lookup then arrives lowercased and misses every mixed-case key, making the rule effectively dead.

The 4.5.1 patch (commit 619963309) applies the same toLowerCase() to each route-rule key during matcher compilation, restoring symmetry. The fix is gated on router.options.sensitive: when sensitive is true, neither side is folded and exact-case matching is preserved on both ends.

CWE-178 (case sensitivity mishandling) is the direct root cause, with CWE-863 (incorrect authorization) as the impact.

The fix

Upgrade to nuxt@4.5.1 (4.x) or nuxt@3.21.10 (3.x). Run: npx nuxt upgrade --dedupe. If you cannot upgrade immediately, either key all routeRules in lowercase so they already match the folded lookup, or set router: { options: { sensitive: true } } to make both routing and rule matching case-sensitive (all request paths must then use exact casing).

A server middleware that enforces auth independently of routeRules also mitigates the gap.

Reporter not attributed.

References: [1][2][3][4][5][6]

Related research