# Nuxt route rules silently dropped for mixed-case paths, bypassing appMiddleware auth gates (incomplete fix for CVE-2026-53721)

Nuxt lowercased route-rule lookup paths but not rule keys, so mixed-case keys like /Admin never matched, dropping appMiddleware auth gates and rendering protected pages to unauthenticated visitors.

- Payout: Research
- Severity: high
- Program: Nuxt
- Found by: Pig-Tail, sec-reex, DavidCarliez
- Disclosed: 2026-08-05
- CVE: CVE-2026-71315
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-hxvh-4h3w-prp9
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-hxvh-4h3w-prp9
- Tags: area:web domain:web impact:internal-access kind:research platform:ghsa sev:high tech:nodejs technique:incomplete-fix technique:source-review vuln:access-control vuln:auth-bypass vuln:misconfiguration

**Target:** Nuxt app-level route-rule matcher (vue-router integration)
**Root cause:** The prior fix for CVE-2026-53721 case-folded only the lookup path, leaving compiled route-rule keys verbatim; mixed-case keys therefore never match the folded lookup, so app-side route-rule behaviours (appMiddleware, appLayout, client redirect, ssr decision, prerender, payload) are silently dropped.
**Steps:**
1. Configure `routeRules: { '/Admin/dashboard': { appMiddleware: 'auth' } }` (or rely on rules derived from `pages/Admin.vue`).
2. Request `/Admin/dashboard`, `/admin/dashboard`, or `/ADMIN/dashboard` as an unauthenticated visitor.
3. vue-router serves the page case-insensitively; the route-rule key `/Admin/dashboard` never matches the lowercased lookup, so `appMiddleware: 'auth'` is not applied.
4. Protected page and its SSR-fetched data render to the unauthenticated visitor instead of redirecting to login.
**How found:** Follow-up on the incomplete fix for CVE-2026-53721: noticed the patch folded only the lookup path while compiled keys stayed verbatim, then tested mixed-case rule keys against case-insensitive vue-router serving.
**Exploitation:** Unauthenticated attacker requests any casing variant of a protected mixed-case route; the auth-gating appMiddleware rule is dropped and the page plus SSR payload is served without authentication.
**Insight:** When a patch normalizes one side of a comparison (lookup) but not the other (stored keys), the fix is asymmetric and still bypassable; audit case-folding fixes for symmetry on both operands, and check framework-derived keys (PascalCase page files) that users never wrote by hand.