@nuxt

Products

Exploited and recent CVEs

• CVE-2026-120309 Low 3.7 Nuxt 4.6.0 before 4.6.2 Route Param Confusion via getRouterParam 0.2%
• CVE-2026-119201 Medium 4.8 Nuxt dev server exposes generated appSecret through Vite file serving 0.2%
• CVE-2026-119200 Medium 6.5 Nuxt: Dot segments in the request path bypass `server/middleware` path checks and server route rules on page routes 0.3%
• CVE-2026-119200 Medium 6.5 Nuxt: Dot segments in the request path bypass `server/middleware` path checks and server route rules on page routes 0.3%
• CVE-2026-119199 Medium 5.9 Nuxt dev server exposes private runtime config through the Nitro dev bundle 0.4%
• CVE-2026-119198 Medium 5.9 Nuxt dev server arbitrary file read through client error reports 0.3%
• CVE-2026-114133 Medium 5.4 Nuxt server islands render `useHeadSafe` input without sanitisation 0.2%
• CVE-2026-114132 Medium 6.3 Nuxt: Server-side route rules (`redirect`, `headers`, `proxy`, `ssr`) are skipped for case-variant paths when routing is case-insensitive 0.4%
• CVE-2026-114131 Medium 6.5 Nuxt: Route rules are matched against the raw request path, so a percent-encoded segment can bypass `appMiddleware` on dynamic and catch-all routes 0.4%
• CVE-2026-114130 Low 2.3 Nuxt: Incomplete fix for GHSA-934w-87qh-qr26: a `javascript:` URL prefixed with an ASCII control character executes from `<NuxtLink>` when `pages` is disabled 0.4%
• CVE-2026-72744 Medium 6.2 Nuxt before 4.5.1 Information Disclosure via Chrome DevTools 0.2%
• CVE-2026-71321 High 7.5 Nuxt: Unauthenticated CPU exhaustion parsing and hashing the Nuxt island endpoint body before hash validation 0.7%
• CVE-2026-71320 High 8.1 Nuxt: Server-Side Remote Code Execution via Runtime Template Injection in Nuxt Server Island Props 0.7%
• CVE-2026-71319 Critical 9.6 Nuxt.js Unauthenticated WebSocket RPC Call Leading to Remote Code Execution 0.6%
• CVE-2026-71318 Medium 4.8 Nuxt: Unauthorized Component Instantiation via Server Island Props 0.3%
• CVE-2026-71316 High 7.5 Nuxt runtime payload cache discloses another user's SSR data across users and to unauthenticated clients 0.5%
• CVE-2026-71315 High 8.2 Nuxt route rules silently dropped for mixed-case paths, bypassing appMiddleware auth gates (incomplete fix for CVE-2026-53721) 0.5%
• CVE-2026-71314 High 7.5 Nuxt: Unauthenticated out-of-memory crash via unbounded v-for expansion in island rendering 0.9%
• CVE-2026-56301 Medium 5.5 Nuxt - Arbitrary File Read via World-Connectable vite-node IPC Socket on Linux 0.1%
• CVE-2026-56698 Medium 6.1 Nuxt - Cross-Site Scripting via navigateTo open Option 0.4%
• CVE-2026-56697 Medium 6.1 Nuxt - Open Redirect via Protocol-Relative Paths in reloadNuxtApp 0.3%
• CVE-2026-56326 Medium 6.1 Nuxt - Server-Side Open Redirect via Path-Normalization Bypass in navigateTo 0.4%
• CVE-2026-56317 Low 2.3 Nuxt - Cross-Site Scripting via NoScript Component Slot Content 0.3%
• CVE-2026-53722 Medium 5.1 Nuxt: Reflected XSS in `<NuxtLink>` via unsanitised `javascript:` or `data:` URL 0.3%
• CVE-2026-53721 High 8.8 Nuxt: Route-rule middleware bypass via case-sensitivity mismatch between vue-router and the routeRules matcher 0.4%
• CVE-2026-47200 Medium 6.3 Nuxt: Route middleware not enforced when rendering `.server.vue` pages via `/__nuxt_island/page_*` 0.2%
• CVE-2026-49993 Medium 5.9 @nuxt/webpack-builder and @nuxt/rspack-builder dev server same-origin check bypassed when Sec-Fetch-Site, Origin, and Referer are all absent (incomplete fix for GHSA-6m52-m754-pw2g) 0.3%
• CVE-2026-45669 Medium 5.3 Nuxt: Reflected XSS in `navigateTo()` external redirect 0.2%
• CVE-2026-45670 Medium 5.9 Nuxt: Dev server exposes built source over LAN to malicious sites (incomplete fix for GHSA-4gf7-ff8x-hq99) 0.2%
• CVE-2026-46342 Low 2.3 Nuxt: `__nuxt_island` endpoint does not bind responses to request props, enabling shared-cache poisoning <0.1%