Loading story…
Nuxt disclosed CVE-2026-71315, a high-severity authorization bypass caused by route rules not matching correctly when applications use case-insensitive routing. In affected versions 3.21.7 through before 3.21.10 and 4.4.7 through before 4.5.1, mixed-case routeRules keys could be silently dropped when router.options.sensitive was false, allowing appMiddleware protections and other path-based controls to fail on differently cased requests. The issue was recorded as an incomplete fix for CVE-2026-53721 and was mapped to CWE-178 and CWE-863.
Nuxt fixed the bug by adding both case-sensitive and case-folded route-rule matchers, selecting behavior at runtime based on router sensitivity, and updating prerender and manifest handling so mixed-case keys are applied consistently. The vendor shipped the remediation in Nuxt 3.21.10 and 4.5.1, alongside tests covering middleware, redirects, SSR, and prerender behavior across request casing, and said users who previously upgraded for the earlier advisory still need this release because the prior route-rule fix introduced a regression. The v3.21.10 security release also bundled fixes for additional issues, including server-side RCE, unauthorized server-island component instantiation, server component denial of service, and development server path disclosure.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
GitHub advisory references for CVE-2026-71315 were published, pointing to the Nuxt fix commits and remediated releases 3.21.10 and 4.5.1. The advisory described the flaw as mixed-case routeRules keys failing to match case-folded lookups when `router.options.sensitive` is false, allowing appMiddleware authorization gates to be dropped.
The CVE record for CVE-2026-71315 was newly received by security-advisories@github.com. The advisory documented a Nuxt vulnerability affecting versions 3.21.7 through before 3.21.10 and 4.4.7 through before 4.5.1, caused by an incomplete fix for CVE-2026-53721.
Nuxt published security release v3.21.10 and urged users to upgrade immediately. The release fixed multiple vulnerabilities, including the route rule authorization bypass, and noted that users who had already upgraded for CVE-2026-53721 still needed this release because one fix addressed a regression from the earlier advisory.
Nuxt committed code changes to fix route-rules matching when routing is case-insensitive, addressing cases where mixed-case routeRules keys could silently fail and drop protections such as appMiddleware, redirects, SSR, or prerender behavior. The patch added folded and case-sensitive matchers, updated manifest and prerender logic, and introduced tests covering mixed-case and sensitive-routing behavior.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcegithub.com
Open sourcegithub.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Nuxt disclosed **CVE-2026-53722**, a reflected DOM-based cross-site scripting flaw in the `<NuxtLink>` component affecting versions before **3.21.7** and **4.4.7**. The bug allowed attacker-controlled values passed into `to` or `href` to be rendered into anchor tags without proper URI scheme sanitization, enabling `javascript:` or `data:` payloads to execute when a victim clicked the link. The issue is exploitable in applications that feed untrusted query parameters or database values into `<NuxtLink>`, and Nuxt fixed it by introducing `sanitizeExternalHref` to block unsafe protocols and abort navigation. Angular also disclosed an SSRF vulnerability in `@angular/platform-server` under **GHSA-rfh7-fxqc-q52v**, caused by server-side rendering logic that accepted absolute-form request URLs and could adopt an attacker-controlled hostname. That behavior could redirect relative `HttpClient` requests or `PlatformLocation.hostname` lookups to attacker infrastructure, potentially exposing internal APIs or cloud metadata services during rendering. Patched releases include **22.0.0-next.12**, **21.2.13**, **20.3.21**, and **19.2.22**; no fix was listed for the **18.x** line. Organizations using either framework were advised to upgrade promptly and, where patching is delayed, enforce URL scheme allowlisting in Nuxt and validate or normalize SSR request URLs in Angular.
Jun 29, 2026
Vercel has patched three high-severity vulnerabilities in **Next.js** that could allow **server-side request forgery (SSRF)** and, in a narrower configuration, bypass middleware-based authentication. The flaws are tracked as `CVE-2026-64645`, `CVE-2026-64649`, and `CVE-2026-64642`, each rated **CVSS 8.3**, and affect multiple supported branches of the framework. According to the advisory coverage, the SSRF issues can be triggered under specific configurations, while the authentication bypass affects deployments using the **App Router** and **Turbopack** in a limited scenario. The issues were fixed in **Next.js 16.2.11** and **15.5.21**, with no public proof-of-concept or confirmed in-the-wild exploitation reported at publication time. Defenders are advised to upgrade promptly, avoid user-controlled external destination hostnames, validate `Host` and `X-Forwarded-Host` headers, and enforce authorization checks in server-side page logic rather than relying solely on middleware protections.
Jul 23, 2026
A critical flaw tracked as **`CVE-2026-71320`** allows remote code execution in the Nuxt framework by abusing server island props passed to the ` /__nuxt_island/ ` endpoint when **`vue.runtimeCompiler: true`** is enabled. The bug affects **Nuxt 3.4.0 through before 3.21.10** and **Nuxt 4.0.0 through before 4.5.1**, where attacker-controlled properties from query strings or request bodies could reach the server-side rendering pipeline and inject a dangerous `template` key into dynamic Vue components, leading to template execution inside the Nitro process. The issue is classified under **`CWE-94`** and **`CWE-74`** and carries a high-impact CVSS vector of **`AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H`**. Nuxt has released fixes in **3.21.10** and **4.5.1** that add deep validation for unsafe island props and reject malicious requests with **HTTP 400** when the runtime compiler is active. The patch introduces a traversal check for the `template` key before props are forwarded into SSR, closing the documented attack path involving dynamic components such as ` <component :is> `. Researchers noted a residual theoretical concern that the validation relies on `Object.keys()` and could be bypassed in a separate prototype-pollution scenario, but the primary mitigation is available now and defenders are also advised to disable **`vue.runtimeCompiler`** in `nuxt.config.ts` where it is not required.
Aug 6, 2026