Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| nuxt | npm | >= 4.0.0, < 4.4.7 | 4.4.7 |
| nuxt | npm | >= 3.11.0, < 3.21.7 | 3.21.7 |
Miggo AIRoot Cause AnalysisThe vulnerability is a middleware bypass caused by a case-sensitivity mismatch between Nuxt's routeRules matcher and vue-router. By default, vue-router matches routes case-insensitively, while the routeRules matcher performed a case-sensitive lookup. The primary vulnerable function is getRouteRules, which takes the request path and attempts to find matching rules. An attacker could craft a URL with different casing than what was defined in the routeRules (e.g., /Admin/dashboard instead of /admin/dashboard). While vue-router would still render the page, getRouteRules would fail to find the corresponding rule, causing any associated middleware, such as authorization, to be skipped. The patch rectifies this by converting the path to lowercase within getRouteRules and in the underlying route matcher template generated by the bundle function, ensuring the lookup is case-insensitive and consistent with vue-router.
getRouteRulespackages/nuxt/src/app/composables/manifest.ts
bundlepackages/nitro-server/src/index.ts