CVE-2026-53721
HIGHNuxt: Route-rule middleware bypass via case-sensitivity mismatch between vue-router and the routeRules matcher
Title source: cnaDescription
Nuxt is an open-source web development framework for Vue.js. From versions 3.11.0 to before 3.21.7 and 4.0.0 to before 4.4.7, there is a route-rule middleware bypass via case-sensitivity mismatch between vue-router and the routeRules matcher. This issue has been patched in versions 3.21.7 and 4.4.7.
References (3)
Core 3
Core References
X_Refsource_Confirm x_refsource_confirm
https://github.com/nuxt/nuxt/security/advisories/GHSA-mm7m-92g8-7m47
X_Refsource_Misc x_refsource_misc
https://github.com/nuxt/nuxt/commit/07e39cd6f26e407b4192b7865bd17bc44536b9bb
X_Refsource_Misc x_refsource_misc
https://github.com/nuxt/nuxt/commit/3f3e3fa7b5eec8e495f4f8ce0a54813a8875a11e
Scores
CVSS v3
8.2
EPSS
0.0029
EPSS Percentile
20.9%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
yes
Technical Impact
total
Details
CWE
CWE-178
CWE-863
Status
published
Products (5)
npm/nuxt
3.11.0 - 3.21.7npm
npm/nuxt
4.0.0 - 4.4.7npm
nuxt/nuxt
3.11.0 - 3.21.7
nuxt/nuxt
>= 3.11.0, < 3.21.7
nuxt/nuxt
>= 4.0.0, < 4.4.7
Published
Jun 12, 2026
Tracked Since
Jun 12, 2026