nuxt vulnerabilities
Nuxt is a free and open-source framework with an intuitive and extendable way to create type-safe, performant and production-grade full-stack web applications and websites with Vue.js.
- Registry
- npm
- Latest
- 4.6.2
- License
- MIT
25 known advisories
The latest version, 4.6.2, is affected by 1 of them.
Security advisories for nuxt
Nuxt: Server-side route rules (`redirect`, `headers`, `proxy`, `ssr`) are skipped for case-variant paths when routing is case-insensitive
- Affected
- >=4.0.0 <4.6.2 · >=3.0.0
- Fixed in
- 4.6.2
Nuxt server islands render `useHeadSafe` input without sanitisation
- Affected
- >=3.13.0 <4.6.2
- Fixed in
- 4.6.2
Nuxt: Incomplete fix for GHSA-934w-87qh-qr26: a `javascript:` URL prefixed with an ASCII control character executes from `<NuxtLink>` when `pages` is disabled
- Affected
- <4.6.0
- Fixed in
- 4.6.0
Nuxt: Route rules are matched against the raw request path, so a percent-encoded segment can bypass `appMiddleware` on dynamic and catch-all routes
- Affected
- >=4.0.0 <4.4.4 · >=3.11.0 <3.21.4
- Fixed in
- 3.21.4, 4.4.4
Nuxt dev server discloses project root and workspace UUID via the Chrome DevTools workspace endpoint
- Affected
- >=4.4.7 <4.5.1 · >=3.21.7 <3.21.10
- Fixed in
- 3.21.10, 4.5.1
Nuxt: Unauthenticated CPU exhaustion parsing and hashing the Nuxt island endpoint body before hash validation
- Affected
- >=4.0.0 <4.5.1 · >=3.1.0 <3.21.10
- Fixed in
- 3.21.10, 4.5.1
Nuxt: Server-Side Remote Code Execution via Runtime Template Injection in Nuxt Server Island Props
- Affected
- >=4.0.0 <4.5.1 · >=3.4.0 <3.21.10
- Fixed in
- 3.21.10, 4.5.1
Nuxt: Unauthorized Component Instantiation via Server Island Props
- Affected
- >=4.0.0 <4.5.1 · >=3.1.0 <3.21.10
- Fixed in
- 3.21.10, 4.5.1
Nuxt runtime payload cache discloses another user's SSR data across users and to unauthenticated clients
- Affected
- >=4.4.0 <4.5.1
- Fixed in
- 4.5.1
Nuxt route rules silently dropped for mixed-case paths, bypassing appMiddleware auth gates (incomplete fix for CVE-2026-53721)
- Affected
- >=4.4.7 <4.5.1 · >=3.21.7 <3.21.10
- Fixed in
- 3.21.10, 4.5.1
Nuxt: Unauthenticated out-of-memory crash via unbounded v-for expansion in island rendering
- Affected
- >=4.0.0 <4.5.1 · >=3.1.0 <3.21.10
- Fixed in
- 3.21.10, 4.5.1
Cross-site scripting via <NoScript> slot content in Nuxt's head components
- Affected
- >=4.0.0 <4.4.7 · <3.21.7
- Fixed in
- 3.21.7, 4.4.7
Nuxt: Reflected XSS in `<NuxtLink>` via unsanitised `javascript:` or `data:` URL
- Affected
- >=4.0.0 <4.4.7 · >=3.0.0 <3.21.7
- Fixed in
- 3.21.7, 4.4.7
Nuxt dev server vite-node IPC socket is world-connectable on Linux
- Affected
- >=4.0.0 <4.4.7 · >=3.18.0 <3.21.7
- Fixed in
- 3.21.7, 4.4.7
Nuxt: Route-rule middleware bypass via case-sensitivity mismatch between vue-router and the routeRules matcher
- Affected
- >=4.0.0 <4.4.7 · >=3.11.0 <3.21.7
- Fixed in
- 3.21.7, 4.4.7
Nuxt: URL-handling weaknesses in `navigateTo` and `reloadNuxtApp`: SSR open redirect, client-side script execution via the `open` option, and protocol-relative bypass in `reloadNuxtApp`
- Affected
- >=4.0.0 <4.4.7 · >=3.5.0 <3.21.7
- Fixed in
- 3.21.7, 4.4.7
Nuxt: Dev server discloses project absolute path and persistent workspace UUID via `/.well-known/appspecific/com.chrome.devtools.json`
- Affected
- >=4.0.0-alpha.1 <4.4.7
- Fixed in
- 4.4.7
Nuxt's route middleware is not enforced when rendering `.server.vue` pages via `/__nuxt_island/page_*`
- Affected
- >=3.11.0 <3.21.6 · >=4.0.0-alpha.1 <4.4.6
- Fixed in
- 3.21.6, 4.4.6
Nuxt: `__nuxt_island` endpoint does not bind responses to request props, enabling shared-cache poisoning
- Affected
- >=3.1.0 <3.21.6 · >=4.0.0-alpha.1 <4.4.6
- Fixed in
- 3.21.6, 4.4.6
Nuxt: Reflected XSS in `navigateTo()` external redirect
- Affected
- >=3.4.3 <3.21.6 · >=4.0.0-alpha.1 <4.4.6
- Fixed in
- 3.21.6, 4.4.6
Nuxt has Client-Side Path Traversal in Nuxt Island Payload Revival
- Affected
- >=3.6.0 <3.19.0 · >=4.0.0 <4.1.0
- Fixed in
- 3.19.0, 4.1.0
Nuxt allows DOS via cache poisoning with payload rendering response
- Affected
- >=3.0.0 <3.16.0
- Fixed in
- 3.16.0
Nuxt vulnerable to remote code execution via the browser when running the test locally
- Affected
- >=3.4.0 <3.12.4
- Fixed in
- 3.12.4
nuxt vulnerable to Cross-site Scripting in navigateTo if used after SSR
- Affected
- <3.12.4
- Fixed in
- 3.12.4
nuxt Code Injection vulnerability
- Affected
- >=3.4.0 <3.4.3
- Fixed in
- 3.4.3
Which of your client projects still run an old nuxt?
NPMscan reads the package-lock.json, yarn.lock and pnpm-lock.yaml in every GitHub repo you pick and checks each installed version against these advisories, including the packages your packages pull in. Each finding comes with the command that fixes it.
Other npm packages
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily. Package details from the npm registry.