Packages / nuxt / Security

HighVulnerabilityGHSA-hxvh-4h3w-prp9Published 5 Aug 2026

Nuxt route rules silently dropped for mixed-case paths, bypassing appMiddleware auth gates (incomplete fix for CVE-2026-53721)

Affected · nuxt

  • >= 4.4.7, < 4.5.1
  • >= 3.21.7, < 3.21.10

Fixed in

4.5.1

npm install nuxt@4.5.1

  1. Not affected

    0.0.1 – 3.21.6

    250 releases

  2. Affected

    3.21.7 – 3.21.9

    3 releases

  3. Fixed

    3.21.10 – 4.4.6

    19 releases

  4. Affected

    4.4.7 – 4.5.0

    3 releases

  5. Fixed

    4.5.1 – 4.6.2

    5 releases, latest

280 stable releases of nuxt, oldest to newest.

What happens

The full text is not stored yet. Read it on osv.dev.