CVE-2026-71315

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-71315
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-71315.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-71315
Aliases
Published
2026-08-05T21:05:15.379Z
Modified
2026-08-08T03:30:36.935179491Z
Severity
  • 8.2 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N CVSS Calculator
Summary
Nuxt route rules silently dropped for mixed-case paths, bypassing appMiddleware auth gates (incomplete fix for CVE-2026-53721)
Details

Nuxt is an open-source web development framework for Vue.js. From 3.21.7 until 3.21.10 and 4.5.1, mixed-case routeRules keys can fail to match case-folded lookups when router.options.sensitive is false and drop appMiddleware authorization gates. This is caused by an incomplete fix for CVE-2026-53721. This issue is fixed in 3.21.10 and 4.5.1.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/71xxx/CVE-2026-71315.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-178",
        "CWE-863"
    ]
}
References

Affected packages

Git / github.com/nuxt/nuxt

Affected ranges

Type
GIT
Repo
https://github.com/nuxt/nuxt
Events
Introduced
b7d57903b947e788fadfcfdf88be7951943731bf
Introduced
fd806be61503f6ccad099c070a5d803777ba8a57
Fixed
452dd50d92ccdf6f456b500e71d0f26baaeff796
Fixed
deafc94128005346ed8ef4dd5e64f940d80377d3
Fixed
619963309e082190bac4a26b05f2dd155b039b81
Fixed
ad624a75ad2d215f43633f6b40be346a7194d34d
Database specific 
{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "4.4.7"
        },
        {
            "fixed": "4.5.1"
        },
        {
            "introduced": "3.21.7"
        },
        {
            "fixed": "3.21.10"
        }
    ]
}

Affected versions

v3.*
v3.21.7
v3.21.8
v3.21.9
v4.*
v4.4.7
v4.4.8
v4.5.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-71315.json"