PT-2026-48880 · Nuxt · Nuxt

Claude · CVE-2026-53721 · Published 2026-06-12 · Updated 2026-06-16

Positive Technologies (AI Summary)

CVSS v4.0

8.8

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Nuxt versions 3.11.0 through 3.21.6 Nuxt versions 4.0.0 through 4.4.6

Description A route-rule middleware bypass exists due to a case-sensitivity mismatch between vue-router and the routeRules matcher.

Recommendations Update to version 3.21.7 for versions in the 3.x branch. Update to version 4.4.7 for versions in the 4.x branch.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-178

CWE-863

Related Identifiers

CVE-2026-53721

GHSA-MM7M-92G8-7M47

Affected Products

Nuxt

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53721.json · Exploit
• https://github.com/nuxt/nuxt/security/advisories/GHSA-mm7m-92g8-7m47 · Vendor Advisory
• https://github.com/nuxt/nuxt/commit/07e39cd6f26e407b4192b7865bd17bc44536b9bb · Patch
• https://github.com/nuxt/nuxt/commit/3f3e3fa7b5eec8e495f4f8ce0a54813a8875a11e · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-53721 · Security Note
• https://osv.dev/vulnerability/GHSA-mm7m-92g8-7m47 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-53721 · Vendor Advisory
• https://github.com/nuxt/nuxt · Note
• https://twitter.com/VulmonFeeds/status/2065476028365955511 · Twitter Post
• https://twitter.com/CVEnew/status/2065461490417565784 · Twitter Post