Executive brief
Nuxt is a popular web development framework. A security flaw exists where the system's internal routing rules and the user-facing router disagree on how to handle uppercase and lowercase letters in web addresses. This allows an attacker to bypass security checks (such as login requirements) by simply changing the capitalization of a URL, potentially gaining unauthorized access to protected pages and data.
Technical details
A vulnerability exists in Nuxt where the `routeRules` matcher performs case-sensitive path matching while the default `vue-router` configuration is case-insensitive. When `appMiddleware` is defined via `routeRules` to act as an authorization gate, an attacker can bypass this middleware by requesting a protected path with modified casing (e.g., `/Admin` instead of `/admin`). Because `vue-router` still resolves the path to the correct page but the `routeRules` lookup fails to find a match, the security middleware is never executed. This results in the server returning fully rendered pages, including data from `useFetch` or `useAsyncData`, to unauthorized users. The issue is fixed in versions 3.21.7 and 4.4.7 by normalizing path lookups to be case-insensitive.
Affected products
- Nuxt nuxt >= 3.11.0, < 3.21.7
- Nuxt nuxt >= 4.0.0, < 4.4.7
Timeline
- 2026-06-02: patched: Fixes released in versions 3.21.7 and 4.4.7
- 2026-06-12: advisory: NVD published date
- 2026-06-16: disclosed: GitHub Advisory published