CVE-2026-71315
1 advisory.
npm/nuxt CVE-2026-71315: high 8.2
Nuxt route rules silently dropped for mixed-case paths, bypassing appMiddleware auth gates (incomplete fix for CVE-2026-53721)
Action: Upgrade nuxt to 3.21.10 or later.
npm i nuxt@4.5.1npm i nuxt@3.21.10Affected
| introduced | fixed | last affected |
|---|---|---|
| 4.4.7 | 4.5.1 | - |
| 3.21.7 | 3.21.10 | - |
Fixed versions
| 4.5.1 | 3.21.10 |
Sources
- osv: GHSA-hxvh-4h3w-prp9
- https://github.com/nuxt/nuxt/security/advisories/GHSA-hxvh-4h3w-prp9
- https://github.com/nuxt/nuxt/commit/619963309e082190bac4a26b05f2dd155b039b81
- https://github.com/nuxt/nuxt/commit/ad624a75ad2d215f43633f6b40be346a7194d34d
- https://github.com/nuxt/nuxt
- https://github.com/nuxt/nuxt/releases/tag/v3.21.10
- https://github.com/nuxt/nuxt/releases/tag/v4.5.1
CVE-2026-71315 · published · modified · JSON