Nuxt 3 routes can silently ignore mixed‑case routeRules keys when the router is not case sensitive, which causes any appMiddleware authorization gates to be skipped. An attacker can therefore access protected endpoints by simply altering the case of the path, bypassing intended authentication and authorization logic without needing to supply valid credentials. This flaw gives attackers unauthorized access to data or functionality that should be protected.

Nuxt version 3.21.7 up through 3.21.9 and Nuxt version 4.5.0 are affected. The issue was fixed in 3.21.10 and 4.5.1 and later releases.

The CVSS score of 8.2 places this issue in the high‑severity range. EPSS data is not available, but the vulnerability is publicly exposed and requires only a crafted HTTP request, making exploitation straightforward for attackers with network access to the application. It is not listed in the CISA KEV catalog, indicating no known public exploits yet, but the high severity warrants swift action.