Is nuxt 2.17 vulnerable?

npm · 5 releases from 2.17.0 to 2.17.4 · latest nuxt is 4.6.3 · checked 1 Nov 2026

Yes: 3 known advisories

Yes. nuxt 2.17.4, the last 2.17 release, is affected by 3 known security advisories (1 medium, 2 low), including CVE-2024-34343, CVE-2026-114130, CVE-2026-56317. Upgrade to 4.6.0 or later to fix all of them.

Upgrade with:npm install nuxt@4.6.0

Is your project affected?

Private repo? Upload its lockfile instead, or connect GitHub to check every repo.

Advisories affecting nuxt 2.17.4

  • LowCVE-2026-114130GHSA-jjm6-p2m9-9w4x22 Oct 2026

    Nuxt: Incomplete fix for GHSA-934w-87qh-qr26: a `javascript:` URL prefixed with an ASCII control character executes from `<NuxtLink>` when `pages` is disabled

    Affected
    <4.6.0
    Fixed in
    4.6.0
  • LowCVE-2026-56317GHSA-m3q2-p4fw-w38m16 Jun 2026

    Cross-site scripting via <NoScript> slot content in Nuxt's head components

    Affected
    >=4.0.0 <4.4.7 · <3.21.7
    Fixed in
    3.21.7, 4.4.7
  • MediumCVE-2024-34343GHSA-vf6r-87q4-2vjf5 Aug 2024

    nuxt vulnerable to Cross-site Scripting in navigateTo if used after SSR

    Affected
    <3.12.4
    Fixed in
    3.12.4

Which of your client projects are still on nuxt 2.17?

NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact nuxt version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

Other nuxt versions

Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the npm registry. Refreshed daily.