Is CVE-2026-53721 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-53721 being exploited in the wild.

How severe is CVE-2026-53721?

High severity, with a CVSS score of 4, published 12 June 2026.

Which products and versions are affected?

nuxt (npm) SEMVER:introduced=4.0.0,fixed=4.4.7.

Is there a fix for CVE-2026-53721?

Yes. nuxt (npm): upgrade to 4.4.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-53721 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-53721?

Check whether you run nuxt (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-53721: Nuxt authorization bypass via case-sensitivity mismatch in routeRules

CVE-2026-53721 · Severity: high · CVSS 4 · Published 2026-06-12

Nuxt is a popular web development framework. A security flaw exists where the system's internal routing rules and the user-facing router disagree on how to handle uppercase and lowercase letters in web addresses. This allows an attacker to bypass security checks (such as login requirements) by simply changing the capitalization of a URL, potentially gaining unauthorized access to protected pages and data.

Technologies: nuxt (npm). Vendors: npm.

Quick answers

Is CVE-2026-53721 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-53721 being exploited in the wild.
How severe is CVE-2026-53721?: High severity, with a CVSS score of 4, published 12 June 2026.
Which products and versions are affected?: nuxt (npm) SEMVER:introduced=4.0.0,fixed=4.4.7.
Is there a fix for CVE-2026-53721?: Yes. nuxt (npm): upgrade to 4.4.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-53721 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-53721?: Check whether you run nuxt (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

nuxt (npm): upgrade to 4.4.7 or later
```
npm install nuxt@4.4.7
```

Technical details

A vulnerability exists in Nuxt where the `routeRules` matcher performs case-sensitive path matching while the default `vue-router` configuration is case-insensitive. When `appMiddleware` is defined via `routeRules` to act as an authorization gate, an attacker can bypass this middleware by requesting a protected path with modified casing (e.g., `/Admin` instead of `/admin`). Because `vue-router` still resolves the path to the correct page but the `routeRules` lookup fails to find a match, the security middleware is never executed. This results in the server returning fully rendered pages, including data from `useFetch` or `useAsyncData`, to unauthorized users. The issue is fixed in versions 3.21.7 and 4.4.7 by normalizing path lookups to be case-insensitive.

Affected products

Nuxt nuxt >= 3.11.0, < 3.21.7
Nuxt nuxt >= 4.0.0, < 4.4.7

Identifiers

CVE-2026-53721
GHSA-mm7m-92g8-7m47

Timeline

2026-06-02: patched: Fixes released in versions 3.21.7 and 4.4.7
2026-06-12: advisory: NVD published date
2026-06-16: disclosed: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.