{"vulnerability": "cve-2026-71315", "sightings": [{"uuid": "0509198f-3244-4996-8a66-3decb6041e83", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-71315", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3msejmylyml2t", "content": "\ud83d\udfe0 CVE-2026-71315 - High (8.2)\n\nNuxt is an open-source web development framework for Vue.js. From 3.21.7 until 3.21.10 and 4.5.1,...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-71315/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-08-05T22:00:24.495158Z"}, {"uuid": "87682d55-8fdf-4add-a3e5-67ae199a16ef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-71315", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/g56cs2qf35unw", "content": "CVE-2026-71315 - Nuxt route rules silently dropped for mixed-case paths, bypassing appMiddleware auth gates (incomplete fix for CVE-2026-53721)\nCVE ID : CVE-2026-71315\n \n Published : Aug. 5, 2026, 9:16 p.m. | 33\u00a0minutes ago\n \n Description : Nuxt is an open-source web developme...", "creation_timestamp": "2026-08-05T22:14:21.848523Z"}, {"uuid": "7449398f-c141-4a36-bef7-246688aa4e3d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-71315", "type": "seen", "source": "https://gist.github.com/alon710/75a8da6231b4389c07987c60b53a1e91", "content": "# CVE-2026-71315: CVE-2026-71315: Nuxt route rules silently dropped for mixed-case paths, bypassing appMiddleware auth gates (incomplete fix for CVE-2026-53721)\n\n> **CVSS Score:** 8.2\n> **Published:** 2026-08-05\n> **Full Report:** https://cvereports.com/reports/CVE-2026-71315\n\n## Summary\nAn security bypass vulnerability exists in Nuxt frameworks where route rules containing mixed-case characters are silently dropped during case-insensitive routing. This occurs because lookups are folded to lowercase, but keys are stored in their original casing in the route-matching trie. As a result, critical authorization middleware, such as appMiddleware, is bypassed, allowing unauthorized access to restricted pages.\n\n## TL;DR\nNuxt route rules are silently bypassed for mixed-case paths due to a key-matching case mismatch, allowing unauthenticated attackers to skip authorization checks.\n\n## Technical Details\n\n- **CWE ID**: CWE-178 / CWE-863\n- **Attack Vector**: Network (AV:N)\n- **CVSS Severity**: 8.2 (High)\n- **Exploit Status**: No public PoC or active exploitation\n- **Impact**: Authorization Bypass & Data Disclosure\n- **Vulnerable Component**: Nuxt Route Rules Matcher\n\n## Affected Systems\n\n- Nuxt Framework\n- **Nuxt**: >= 3.21.7, < 3.21.10 (Fixed in: `3.21.10`)\n- **Nuxt**: >= 4.4.7, < 4.5.1 (Fixed in: `4.5.1`)\n\n## Mitigation\n\n- Upgrade Nuxt framework\n- Normalize routeRules to lowercase\n- Enable router.options.sensitive\n- Implement component-level auth guards\n\n**Remediation Steps:**\n1. Identify administrative or sensitive routes protected via routeRules.\n2. Update Nuxt dependency in package.json to ^3.21.10 or ^4.5.1.\n3. Verify and convert existing routeRules keys to lowercase as a defense-in-depth measure.\n4. Run npm install or yarn install to apply the framework updates.\n\n## References\n\n- [GitHub Security Advisory GHSA-hxvh-4h3w-prp9](https://github.com/nuxt/nuxt/security/advisories/GHSA-hxvh-4h3w-prp9)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-71315) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-06T05:31:22.184696Z"}]}