AIKIDO-2026-174775
nuxt is vulnerable to Improper Handling of Case Sensitivity
82
High Risk
This Affects:
nuxtTL;DR
Nuxt contains an authorization bypass vulnerability in its app-level route rule matching. Route rules with uppercase characters may fail to match due to inconsistent case normalization, causing protections such as authentication middleware, client redirects, SSR controls, and other app-level route rules to be skipped. An attacker can access protected pages using differently cased URLs when applications rely on affected mixed-case route rules.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
nuxt is vulnerable to Improper Handling of Case Sensitivity in versions 3.21.7 - 3.21.9 and 4.4.7 - 4.5.0.
How to fix this
Upgrade to a patched version. If this is not possible, define route rules using lowercase paths, enable case-sensitive routing (router.options.sensitive: true), or enforce authorization with server-side middleware instead of relying solely on route rules.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant