CVE-2026-53721: Nuxt: Route-rule middleware bypass via case-sensitivity mismatch between vue-router and the routeRules matcher

Synopsis

A middleware-bypass vulnerability affects the Nuxt web framework (versions 3.11.0 to before 3.21.7 and 4.0.0 to before 4.4.7). An attacker can reach it over the network with no authentication by crafting a URL whose casing does not match the routeRules matcher but is accepted by vue-router, causing route-rule middleware to be skipped entirely. Successful exploitation lets an attacker read protected data and make limited modifications to application state. Patched-image rebuilds at versions 3.21.7 and 4.4.7 are available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the Nuxt application over the network; the vulnerability is exposed on any internet- or intranet-facing deployment.

• AuthenticationNot required

  No account or session credential is needed; the crafted request can be sent by any unauthenticated client.

• Victim interactionNot required

  No user action is required; the attacker sends the request directly to the server without involving any human victim.

• Attack complexityDetail

  Exploitation is reliable and condition-free; the attacker only needs to adjust the casing of the route path, with no race conditions or environmental dependencies involved.

Blast Radius

• The attacker bypasses route-rule middleware and reads response data that should be access-controlled, such as session tokens, user records, or API responses gated behind those rules.
• The attacker can make limited writes or state modifications to resources that route-rule middleware was intended to restrict, such as submitting forms or triggering actions on protected endpoints.
• Confidentiality impact is high; any data served by routes whose middleware protection is bypassed is fully readable by the attacker.
• Availability of the service itself is not affected by this vulnerability.