Is nuxt 3.10 vulnerable?
npm · 4 releases from 3.10.0 to 3.10.3 · latest nuxt is 4.6.3 · checked 2 Nov 2026
Yes: 15 known advisories
Yes. nuxt 3.10.3, the last 3.10 release, is affected by 15 known security advisories (1 critical, 4 high, 6 medium, 4 low), including CVE-2024-34344, CVE-2026-71321, CVE-2026-71320. Upgrade to 4.6.2 or later to fix all of them.
npm install nuxt@4.6.2Advisories affecting nuxt 3.10.3
Nuxt: Server-side route rules (`redirect`, `headers`, `proxy`, `ssr`) are skipped for case-variant paths when routing is case-insensitive
- Affected
- >=4.0.0 <4.6.2 · >=3.0.0
- Fixed in
- 4.6.2
Nuxt: Incomplete fix for GHSA-934w-87qh-qr26: a `javascript:` URL prefixed with an ASCII control character executes from `<NuxtLink>` when `pages` is disabled
- Affected
- <4.6.0
- Fixed in
- 4.6.0
Nuxt: Unauthenticated CPU exhaustion parsing and hashing the Nuxt island endpoint body before hash validation
- Affected
- >=4.0.0 <4.5.1 · >=3.1.0 <3.21.10
- Fixed in
- 3.21.10, 4.5.1
Nuxt: Server-Side Remote Code Execution via Runtime Template Injection in Nuxt Server Island Props
- Affected
- >=4.0.0 <4.5.1 · >=3.4.0 <3.21.10
- Fixed in
- 3.21.10, 4.5.1
Nuxt: Unauthorized Component Instantiation via Server Island Props
- Affected
- >=4.0.0 <4.5.1 · >=3.1.0 <3.21.10
- Fixed in
- 3.21.10, 4.5.1
Nuxt: Unauthenticated out-of-memory crash via unbounded v-for expansion in island rendering
- Affected
- >=4.0.0 <4.5.1 · >=3.1.0 <3.21.10
- Fixed in
- 3.21.10, 4.5.1
Cross-site scripting via <NoScript> slot content in Nuxt's head components
- Affected
- >=4.0.0 <4.4.7 · <3.21.7
- Fixed in
- 3.21.7, 4.4.7
Nuxt: Reflected XSS in `<NuxtLink>` via unsanitised `javascript:` or `data:` URL
- Affected
- >=4.0.0 <4.4.7 · >=3.0.0 <3.21.7
- Fixed in
- 3.21.7, 4.4.7
Nuxt: URL-handling weaknesses in `navigateTo` and `reloadNuxtApp`: SSR open redirect, client-side script execution via the `open` option, and protocol-relative bypass in `reloadNuxtApp`
- Affected
- >=4.0.0 <4.4.7 · >=3.5.0 <3.21.7
- Fixed in
- 3.21.7, 4.4.7
Nuxt: `__nuxt_island` endpoint does not bind responses to request props, enabling shared-cache poisoning
- Affected
- >=3.1.0 <3.21.6 · >=4.0.0-alpha.1 <4.4.6
- Fixed in
- 3.21.6, 4.4.6
Nuxt: Reflected XSS in `navigateTo()` external redirect
- Affected
- >=3.4.3 <3.21.6 · >=4.0.0-alpha.1 <4.4.6
- Fixed in
- 3.21.6, 4.4.6
Nuxt has Client-Side Path Traversal in Nuxt Island Payload Revival
- Affected
- >=3.6.0 <3.19.0 · >=4.0.0 <4.1.0
- Fixed in
- 3.19.0, 4.1.0
Nuxt allows DOS via cache poisoning with payload rendering response
- Affected
- >=3.0.0 <3.16.0
- Fixed in
- 3.16.0
Nuxt vulnerable to remote code execution via the browser when running the test locally
- Affected
- >=3.4.0 <3.12.4
- Fixed in
- 3.12.4
nuxt vulnerable to Cross-site Scripting in navigateTo if used after SSR
- Affected
- <3.12.4
- Fixed in
- 3.12.4
Which of your client projects are still on nuxt 3.10?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact nuxt version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other nuxt versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the npm registry. Refreshed daily.