{"action":"Upgrade nuxt to 3.21.7 or later.","affected":[{"fixed":"4.4.7","introduced":"4.0.0"},{"fixed":"3.21.7","introduced":"3.11.0"}],"component":"nuxt","cve_ids":["CVE-2026-53721"],"ecosystem":"npm","epss":0.00399,"exploited":false,"fixed_versions":["4.4.7","3.21.7"],"ghsa_id":"GHSA-mm7m-92g8-7m47","id":"tcs_01M5KG11FQ3Z96WXJXXFYP80R8","modified_at":"2026-06-16T14:11:27.850739Z","published_at":"2026-06-16T13:48:31Z","references":["https://osv.dev/vulnerability/GHSA-mm7m-92g8-7m47","https://github.com/nuxt/nuxt/security/advisories/GHSA-mm7m-92g8-7m47","https://nvd.nist.gov/vuln/detail/CVE-2026-53721","https://github.com/nuxt/nuxt/commit/07e39cd6f26e407b4192b7865bd17bc44536b9bb","https://github.com/nuxt/nuxt/commit/3f3e3fa7b5eec8e495f4f8ce0a54813a8875a11e","https://github.com/nuxt/nuxt"],"severity":{"label":"high","score":8.2},"sources":[{"source":"osv","source_id":"GHSA-mm7m-92g8-7m47","url":"https://osv.dev/vulnerability/GHSA-mm7m-92g8-7m47"},{"source":"nvd","source_id":"CVE-2026-53721","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53721"}],"summary":"Nuxt: Route-rule middleware bypass via case-sensitivity mismatch between vue-router and the routeRules matcher"}