Is nuxt 4.6 vulnerable?
npm · 4 releases from 4.6.0 to 4.6.3 · latest nuxt is 4.6.3 · checked 1 Nov 2026
Yes: 1 known advisory
Yes. nuxt 4.6.3, the last 4.6 release, is affected by 1 known security advisory (1 medium), including CVE-2026-114132. 2 more affect earlier 4.6.x releases. At least one has no fixed release yet.
Advisories affecting nuxt 4.6.3
Nuxt: Server-side route rules (`redirect`, `headers`, `proxy`, `ssr`) are skipped for case-variant paths when routing is case-insensitive
- Affected
- >=4.0.0 <4.6.2 · >=3.0.0
- Fixed in
- 4.6.2
Fixed within 4.6.x, affecting earlier releases
Nuxt: Dot segments in the request path bypass `server/middleware` path checks and server route rules on page routes
- Affected
- >=4.6.0 <4.6.3
- Fixed in
- 4.6.3
Nuxt server islands render `useHeadSafe` input without sanitisation
- Affected
- >=3.13.0 <4.6.2
- Fixed in
- 4.6.2
Which of your client projects are still on nuxt 4.6?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact nuxt version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other nuxt versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the npm registry. Refreshed daily.