Summary
Nuxt can mishandle mixed-case routeRules keys when router.options.sensitive is disabled, causing case-folded route lookups to miss authorization-related appMiddleware protections. An attacker who can send requests to an affected application may reach routes that should be gated by middleware.
Affected context
The issue occurs in Nuxt applications using affected framework versions where:
- Route rules contain mixed-case keys
router.options.sensitiveis set tofalse- Authorization controls depend on
appMiddlewareroute gates - Case-folded route matching is used during request processing
The behavior results from an incomplete correction for an earlier route-matching vulnerability and may vary according to application routing and middleware configuration.
Exploit preconditions
- Attack surface: Network-accessible application routes
- Required access: Ability to send requests to the affected Nuxt application
- Trigger point: Route resolution and middleware authorization evaluation
- Why exploitation is possible: Case normalization can prevent mixed-case
routeRulesentries from matching the lookup key, allowing an authorization gate to be omitted
Why this happens
The underlying flaw is inconsistent handling of character case between route-rule definitions and route lookups. When routing is configured as case-insensitive, mixed-case keys may not be normalized or compared consistently, so an authorization rule can fail to match the requested route.
This maps primarily to CWE-863: Incorrect Authorization, because a protected operation may proceed without its intended access-control check. It is also related to CWE-178: Improper Handling of Case Sensitivity, because inconsistent case processing affects security-relevant rule matching.
Potential impact
- Attackers may access routes intended to require authorization
- Protected application functionality may be exposed
- Sensitive data may be disclosed through improperly gated endpoints
- Unauthorized state-changing actions could be performed
- Downstream authorization assumptions may be bypassed
General mitigation guidance
Mitigation generally focuses on making security-sensitive route matching deterministic and ensuring authorization is enforced independently of fragile key comparisons.
Common defensive patterns include:
- Normalizing route-rule keys and lookup values consistently before comparison
- Avoiding mixed-case security-control identifiers where practical
- Enforcing authorization in middleware or handlers that do not rely solely on route-rule matching
- Using explicit, deny-by-default access policies for protected routes
- Testing equivalent route forms, including case variations, in security regression suites
- Applying least privilege to authenticated users and service identities
- Keeping framework components within maintained, security-supported release lines
How teams detect issues like this
Organizations can identify this class of issue through:
- Static analysis and configuration checks for mixed-case route-rule keys
- Code review of case-sensitivity settings and authorization middleware registration
- Tests that compare protected and unprotected behavior across case variants of the same route
- Dynamic checks confirming that every sensitive endpoint consistently invokes its authorization gate
- Policy enforcement requiring explicit authorization at sensitive handlers rather than relying only on routing metadata
- Automated dependency and security review tools that flag known framework issues and authorization regressions
