Is nuxt 4.5 vulnerable?
npm · 3 releases from 4.5.0 to 4.5.2 · latest nuxt is 4.6.3 · checked 1 Nov 2026
Yes: 3 known advisories
Yes. nuxt 4.5.2, the last 4.5 release, is affected by 3 known security advisories (2 medium, 1 low), including CVE-2026-114132, CVE-2026-114133, CVE-2026-114130. 7 more affect earlier 4.5.x releases. Upgrade to 4.6.2 or later to fix all of them.
npm install nuxt@4.6.2Advisories affecting nuxt 4.5.2
Nuxt: Server-side route rules (`redirect`, `headers`, `proxy`, `ssr`) are skipped for case-variant paths when routing is case-insensitive
- Affected
- >=4.0.0 <4.6.2 · >=3.0.0
- Fixed in
- 4.6.2
Nuxt server islands render `useHeadSafe` input without sanitisation
- Affected
- >=3.13.0 <4.6.2
- Fixed in
- 4.6.2
Nuxt: Incomplete fix for GHSA-934w-87qh-qr26: a `javascript:` URL prefixed with an ASCII control character executes from `<NuxtLink>` when `pages` is disabled
- Affected
- <4.6.0
- Fixed in
- 4.6.0
Fixed within 4.5.x, affecting earlier releases
Nuxt dev server discloses project root and workspace UUID via the Chrome DevTools workspace endpoint
- Affected
- >=4.4.7 <4.5.1 · >=3.21.7 <3.21.10
- Fixed in
- 3.21.10, 4.5.1
Nuxt: Unauthenticated CPU exhaustion parsing and hashing the Nuxt island endpoint body before hash validation
- Affected
- >=4.0.0 <4.5.1 · >=3.1.0 <3.21.10
- Fixed in
- 3.21.10, 4.5.1
Nuxt: Server-Side Remote Code Execution via Runtime Template Injection in Nuxt Server Island Props
- Affected
- >=4.0.0 <4.5.1 · >=3.4.0 <3.21.10
- Fixed in
- 3.21.10, 4.5.1
Nuxt: Unauthorized Component Instantiation via Server Island Props
- Affected
- >=4.0.0 <4.5.1 · >=3.1.0 <3.21.10
- Fixed in
- 3.21.10, 4.5.1
Nuxt runtime payload cache discloses another user's SSR data across users and to unauthenticated clients
- Affected
- >=4.4.0 <4.5.1
- Fixed in
- 4.5.1
Nuxt route rules silently dropped for mixed-case paths, bypassing appMiddleware auth gates (incomplete fix for CVE-2026-53721)
- Affected
- >=4.4.7 <4.5.1 · >=3.21.7 <3.21.10
- Fixed in
- 3.21.10, 4.5.1
Nuxt: Unauthenticated out-of-memory crash via unbounded v-for expansion in island rendering
- Affected
- >=4.0.0 <4.5.1 · >=3.1.0 <3.21.10
- Fixed in
- 3.21.10, 4.5.1
Which of your client projects are still on nuxt 4.5?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact nuxt version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other nuxt versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the npm registry. Refreshed daily.