CVE-2026-71315

This vulnerability stems from an asymmetry in how Nuxt handles URL routing versus routeRules configuration when case-insensitive routing is enabled. When you set `router.options.sensitive = false` (often done to improve user experience by forgiving URL typos), Nuxt performs case-folded lookups against your routeRules. However, if you've defined routeRules with mixed-case keys—such as `/Admin/dashboard` or `/User/settings`—those keys will silently fail to match when an attacker varies the case in the requested URL. The request then proceeds without the authorization middleware that was supposed to protect it. The root issue is that a non-matching routeRules key returns a no-op rather than a fail-safe denial. Your authorization middleware is simply never invoked because Nuxt treats the case mismatch as a legitimate route that has no special configuration. An attacker can bypass authentication on protected admin, user, or dashboard routes by simply capitalizing or lowercasing path segments in ways you didn't anticipate. What makes this particularly dangerous is the silent failure mode. Unlike a misconfiguration that would error or log a warning, this bypasses security controls without any visible indicator that something went wrong. The request looks normal in logs—it just lacks the middleware that should have enforced access control. To defend against this, you should audit your routeRules keys and ensure all security-sensitive routes use lowercase or consistently-cased keys that will match regardless of how the URL is cased. If your application requires mixed-case routeRules, consider whether `router.options.sensitive = false` is appropriate given your threat model. The safer pattern is to keep case-sensitive routing enabled for any route that has authorization requirements, or normalize all routeRules keys to lowercase at registration time and design your URL structure accordingly. Evaluate the 3.21.10/4.5.1 patch carefully: if it only adds documentation or warnings about this interaction rather than fixing the lookup behavior to fail-safe, the bypass remains structurally present and your authorization boundaries are still at risk.

Reviewed through automated stages and approved by a human before publication.