Is nuxt 3.20 vulnerable?
npm · 3 releases from 3.20.0 to 3.20.2 · latest nuxt is 4.6.3 · checked 1 Nov 2026
Yes: 16 known advisories
Yes. nuxt 3.20.2, the last 3.20 release, is affected by 16 known security advisories (4 high, 9 medium, 3 low), including CVE-2026-71321, CVE-2026-71320, CVE-2026-71314. Upgrade to 4.6.2 or later to fix all of them.
npm install nuxt@4.6.2Advisories affecting nuxt 3.20.2
Nuxt: Server-side route rules (`redirect`, `headers`, `proxy`, `ssr`) are skipped for case-variant paths when routing is case-insensitive
- Affected
- >=4.0.0 <4.6.2 · >=3.0.0
- Fixed in
- 4.6.2
Nuxt server islands render `useHeadSafe` input without sanitisation
- Affected
- >=3.13.0 <4.6.2
- Fixed in
- 4.6.2
Nuxt: Incomplete fix for GHSA-934w-87qh-qr26: a `javascript:` URL prefixed with an ASCII control character executes from `<NuxtLink>` when `pages` is disabled
- Affected
- <4.6.0
- Fixed in
- 4.6.0
Nuxt: Route rules are matched against the raw request path, so a percent-encoded segment can bypass `appMiddleware` on dynamic and catch-all routes
- Affected
- >=4.0.0 <4.4.4 · >=3.11.0 <3.21.4
- Fixed in
- 3.21.4, 4.4.4
Nuxt: Unauthenticated CPU exhaustion parsing and hashing the Nuxt island endpoint body before hash validation
- Affected
- >=4.0.0 <4.5.1 · >=3.1.0 <3.21.10
- Fixed in
- 3.21.10, 4.5.1
Nuxt: Server-Side Remote Code Execution via Runtime Template Injection in Nuxt Server Island Props
- Affected
- >=4.0.0 <4.5.1 · >=3.4.0 <3.21.10
- Fixed in
- 3.21.10, 4.5.1
Nuxt: Unauthorized Component Instantiation via Server Island Props
- Affected
- >=4.0.0 <4.5.1 · >=3.1.0 <3.21.10
- Fixed in
- 3.21.10, 4.5.1
Nuxt: Unauthenticated out-of-memory crash via unbounded v-for expansion in island rendering
- Affected
- >=4.0.0 <4.5.1 · >=3.1.0 <3.21.10
- Fixed in
- 3.21.10, 4.5.1
Cross-site scripting via <NoScript> slot content in Nuxt's head components
- Affected
- >=4.0.0 <4.4.7 · <3.21.7
- Fixed in
- 3.21.7, 4.4.7
Nuxt: Reflected XSS in `<NuxtLink>` via unsanitised `javascript:` or `data:` URL
- Affected
- >=4.0.0 <4.4.7 · >=3.0.0 <3.21.7
- Fixed in
- 3.21.7, 4.4.7
Nuxt dev server vite-node IPC socket is world-connectable on Linux
- Affected
- >=4.0.0 <4.4.7 · >=3.18.0 <3.21.7
- Fixed in
- 3.21.7, 4.4.7
Nuxt: Route-rule middleware bypass via case-sensitivity mismatch between vue-router and the routeRules matcher
- Affected
- >=4.0.0 <4.4.7 · >=3.11.0 <3.21.7
- Fixed in
- 3.21.7, 4.4.7
Nuxt: URL-handling weaknesses in `navigateTo` and `reloadNuxtApp`: SSR open redirect, client-side script execution via the `open` option, and protocol-relative bypass in `reloadNuxtApp`
- Affected
- >=4.0.0 <4.4.7 · >=3.5.0 <3.21.7
- Fixed in
- 3.21.7, 4.4.7
Nuxt's route middleware is not enforced when rendering `.server.vue` pages via `/__nuxt_island/page_*`
- Affected
- >=3.11.0 <3.21.6 · >=4.0.0-alpha.1 <4.4.6
- Fixed in
- 3.21.6, 4.4.6
Nuxt: `__nuxt_island` endpoint does not bind responses to request props, enabling shared-cache poisoning
- Affected
- >=3.1.0 <3.21.6 · >=4.0.0-alpha.1 <4.4.6
- Fixed in
- 3.21.6, 4.4.6
Nuxt: Reflected XSS in `navigateTo()` external redirect
- Affected
- >=3.4.3 <3.21.6 · >=4.0.0-alpha.1 <4.4.6
- Fixed in
- 3.21.6, 4.4.6
Which of your client projects are still on nuxt 3.20?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact nuxt version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other nuxt versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the npm registry. Refreshed daily.