ZDF
Sign inSign up

Vulnerabilities

Security fix · CVE-2026-53721

Route-rule middleware bypass via case-sensitivity mismatch between vue-router and the routeRules matcher

Published Jun 2, 2026 · catalog updated Jun 10, 2026 · Route-rule middleware bypass via

Last checked Nov 2, 2026. A connected source was read within the last 7 days.

Check if you run it

No confirmed exploitation is on record for CVE-2026-53721. EPSS is 0.40%. Act only if a listed version of Route-rule middleware bypass via is installed.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (Route-rule middleware bypass via).
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
High—
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.40%
Remediation
Version ranges on file
Affected products
npm nuxt

## Impact Nuxt looks up for the current navigation by calling from the page-router plugin and the no-pages router plugin. The compiled matcher (built on ) performs case-sensitive matching, while vue-router is configured with its default and matches paths case-insensitively. The two routers therefore disagree on which rules apply to a given request path: vue-router still matches the page record for , but the lookup for the same path returns no match. Any declared via is never added to the middleware set and never runs, on both SSR and client navigations. The same path skips other path-keyed route rules in the same way ( , , , and the prerender / payload hints used client-side). For applications using with as an authorization gate (a documented pattern), an attacker can flip the case of any static segment in a protected URL (for example instead of ) to render the protected page with the middleware skipped. The server returns the fully server-rendered page including any / results captured during SSR. This is an instance of CWE-178 (Improper Handling of Case Sensitivity) leading to CWE-863 (Incorrect Authorization) for apps that treat as an authorization boundary. ## Mitigating factors - Only affects apps that use . The more idiomatic is bound to the matched route record and is unaffected. - Nuxt route middleware is documented as an app-layer concern, not a server-side auth boundary; well-built apps enforce authorization again at the API / data-fetching layer. - Apps that explicitly set are not affected. ## Patches Fixed in (commit [ ](https://github.com/nuxt/nuxt/commit/07e39cd6f26e407b4192b7865bd17bc44536b9bb)) and backported to (commit [ ](https://github.com/nuxt/nuxt/commit/3f3e3fa7b5eec8e495f4f8ce0a54813a8875a11e)). The fix normalizes the path used for lookups so it matches vue-router's default case-insensitive semantics. ## Workarounds Until you can upgrade, you can mitigate by either: 1. Setting so vue-router matches case-sensitively (this changes route-matching

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • npm nuxt>= 3.11.0, < 3.21.7
  • npm nuxt>= 4.0.0, < 4.4.7

How to fix CVE-2026-53721

  • Upgrade

    CVE-2026-53721 lists a fix boundary at 3.21.7. Compare the installed build with that boundary before you change production.

  • Version check

    Affected < 3.21.7

  • Advisory

    Open the inventory_github record and follow its fix.

  • Official advisories

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-53721. EPSS is 0.40%. Act only if a listed version of Route-rule middleware bypass via is installed.

Which versions are affected?

Compare what you have installed with >= 3.11.0, < 3.21.7, >= 4.0.0, < 4.4.7. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-178; CWE-863: Incorrect Authorization. EPSS 0.40%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Technology hubs

Nuxt security

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Jun 2, 2026 · Maintainer security tabs

    Detected

    ## Impact Nuxt looks up for the current navigation by calling from the page-router plugin and the no-pages router plugin. The compiled matcher (built on ) performs case-sensitive matching, while vue-router is configured with its default and matches paths case-insensitively. The two routers therefore disagree on which rules apply to a given request path: vue-router still matches the page record for

  2. Jun 10, 2026 · Maintainer security tabs

    Updated

    ## Impact Nuxt looks up for the current navigation by calling from the page-router plugin and the no-pages router plugin. The compiled matcher (built on ) performs case-sensitive matching, while vue-router is configured with its default and matches paths case-insensitively. The two routers therefore disagree on which rules apply to a given request path: vue-router still matches the page record for

Sources

  • Maintainer security tabsVendor advisoryGHSA-mm7m-92g8-7m47

    ## Impact Nuxt looks up for the current navigation by calling from the page-router plugin and the no-pages router plugin. The compiled matcher (built on ) performs case-sensitive matching, while vue-router is configured with its default and matches paths case-insensitively. The two routers therefore disagree on which rules apply to a given request path: vue-router still matches the page record for

    github.com

Freshness

Last verified in this catalog Nov 2, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

  • Maintainer security tabsNov 2, 2026