Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| nuxt | npm | >= 4.4.7, < 4.5.1 | 4.5.1 |
| nuxt | npm | >= 3.21.7, < 3.21.10 | 3.21.10 |
Miggo AIRoot Cause AnalysisThe vulnerability is an authorization bypass caused by improper case handling in Nuxt's route-rule matching logic. The root cause is a mismatch between how route paths were handled at runtime and how route rule keys were compiled at build time.
At build time, the getRouteRulesRouter function (in packages/nitro-server/src/index.ts) compiled route rules into a matcher using the literal, case-sensitive keys provided in the configuration (e.g., /Admin/dashboard).
At runtime, the getRouteRules function (in packages/nuxt/src/app/composables/manifest.ts) would take the incoming request path and incorrectly convert it to lowercase before attempting to find a matching rule.
This meant a request for /Admin/dashboard would be lowercased to /admin/dashboard for the lookup, which would not match the case-sensitive key /Admin/dashboard in the compiled matcher. As a result, the rule (and any security middleware like appMiddleware: 'auth') was silently dropped, granting access to protected pages without authentication.
The patch addresses this by making the key and lookup normalization symmetric. The getRouteRulesRouter function now case-folds the rule keys to lowercase when the router is configured for case-insensitive matching, ensuring that the compiled rules will match the lookup paths. Correspondingly, the getRouteRules function was changed to no longer perform the lowercasing itself, delegating that responsibility to the newly corrected matcher.
getRouteRulespackages/nuxt/src/app/composables/manifest.ts
getRouteRulesRouterpackages/nitro-server/src/index.ts