| 2026-08-07 | Nuxt dev server discloses project root and workspace UUID via the Chrome DevTools workspace endpointImpact
When a Nuxt dev server is bound to a network-reachable interface (for example nuxt dev --host for on-device testing), the default-enabled Chrome DevTools workspace endpoint GET /.well-known/appspecific/com.chrome.devtools.json returns the absolute project root (workspace.root, i.e. rootDir) and a persistent per-project workspace UUID.
GHSA-rq7w-g337-39qq added a gate (isLocalDevRequest) intended to restrict this endpoint to local requests, but that gate is header-based: it trusts request m…
Component: nuxt | Medium | >= 4.4.7, < 4.5.1; >= 3.21.7, < 3.21.10 | 3.21.10, 4.5.1 | CVE-2026-72744 |
| 2026-08-05 | Nuxt route rules silently dropped for mixed-case paths, bypassing appMiddleware auth gates (incomplete fix for CVE-2026-53721)Impact
Nuxt matches route rules case-insensitively by default (mirroring vue-router’s default sensitive: false routing). The fix for GHSA-mm7m-92g8-7m47 / CVE-2026-53721 lowercased the lookup path before matching route rules, but the route-rule keys compiled into the matcher were left verbatim. As a result, any route rule whose key contains an uppercase character (for example /Admin, /Dashboard/**, or the rules Nuxt derives from PascalCase/camelCase page files such as pages/Admin.vue) never matche… Component: nuxt | High | >= 4.4.7, < 4.5.1; >= 3.21.7, < 3.21.10 | 3.21.10, 4.5.1 | CVE-2026-71315 |
| 2026-08-05 | Nuxt runtime payload cache discloses another user’s SSR data across users and to unauthenticated clientsImpact
When a page is covered by routeRules cache / swr / isr, Nuxt enables runtime payload extraction and serves /<page>/_payload.json. On affected versions the renderer stored the SSR payload in the shared cache:nuxt:payload storage under a path-only key (no cookie, authorization, or cache.varies dimension) and, on a later payload request, returned the cached entry before route middleware / page guards ran again.
As a result, once any authenticated user warms a protected, cached page, a sub… Component: nuxt | High | >= 4.4.0, <= 4.5.0 | 4.5.1 | CVE-2026-71316 |
| 2026-08-05 | Nuxt: Server-Side Remote Code Execution via Runtime Template Injection in Nuxt Server Island PropsImpact
Nuxt server islands accept props via the /__nuxt_island/ endpoint. When vue.runtimeCompiler: true is enabled (off by default) and the application has a server island component that forwards props into Vue’s dynamic component resolution (<component :is>, resolveDynamicComponent, or h()), an attacker can inject a template key into the island props to achieve server-side remote code execution in the Nitro process.
{ "as": { "template": "<attacker-controlled>" } }
Vue’s runtime tem… Component: nuxt | High | >= 4.0.0, < 4.5.1; >= 3.4.0, < 3.21.10 | 3.21.10, 4.5.1 | CVE-2026-71320 |
| 2026-08-05 | Nuxt: Unauthenticated CPU exhaustion parsing and hashing the Nuxt island endpoint body before hash validationImpact
The internal island renderer endpoint (/__nuxt_island/...) decodes and hashes attacker-controlled request input before it validates the URL-resident hash. An unauthenticated POST /__nuxt_island/<name>_<anything>.json with a large JSON body (for example ~4.6 MB / 150k keys) is fully read, destr-parsed, and run through ohash before the request is rejected with a 400. Because Nitro runs on a single event loop, this both wastes CPU on the doomed request and delays every concurrent request. A low re… Component: nuxt | High | >= 4.0.0, < 4.5.1; >= 3.1.0, < 3.21.10 | 3.21.10, 4.5.1 | CVE-2026-71321 |
| 2026-08-05 | Nuxt: Unauthenticated out-of-memory crash via unbounded v-for expansion in island renderingImpact
An unauthenticated attacker can crash a Nuxt server that renders any island / server component containing a v-for over a prop (for example v-for="n in count" or a <slot v-for>). Because the island URL hash is a non-secret digest of the request, the attacker can compute a valid hash for arbitrary props and send the iterated prop as a large integer. The server then expands the v-for to that many nodes during SSR, allocating memory proportional to the attacker’s number. Reporter figures: `count=80… Component: nuxt | High | >= 4.0.0, < 4.5.1; >= 3.1.0, < 3.21.10 | 3.21.10, 4.5.1 | CVE-2026-71314 |
| 2026-08-05 | Nuxt: Unauthorized Component Instantiation via Server Island PropsImpact
Nuxt server islands accept props via the /__nuxt_island/ endpoint. When an application has a server island component that forwards props directly into Vue’s dynamic component resolution (<component :is>, resolveDynamicComponent, or h()), an attacker can pass a plain string value (rather than a component definition) to instantiate any globally-registered Vue component or any native HTML element.
For example:
{ "as": "SomeGlobalComponent" }
…resolves and renders `SomeGlobalComponen… Component: nuxt | Medium | >= 4.0.0, < 4.5.1; >= 3.1.0, < 3.21.10 | 3.21.10, 4.5.1 | CVE-2026-71318 |
| 2026-06-16 | Cross-site scripting via <NoScript> slot content in Nuxt’s head componentsImpact
Nuxt’s globally registered <NoScript> component (from @unhead/vue head components, re-exported by Nuxt) wrote its default-slot content to the innerHTML of the <noscript> head tag, bypassing the HTML escaping that {{ }} interpolation normally applies in Vue templates.
Applications that placed untrusted, attacker-controllable data inside a <NoScript> slot, for example:
<NoScript>{{ route.query.banner }}</NoScript>
would emit that value unescaped inside <noscript> in the server… Component: nuxt | Low | >= 4.0.0, < 4.4.7; < 3.21.7 | 3.21.7, 4.4.7 | CVE-2026-56317 |
| 2026-06-16 | Nuxt dev server vite-node IPC socket is world-connectable on LinuxImpact
When running nuxt dev on Linux (Node.js 20+, outside Docker / StackBlitz), Nuxt’s internal vite-node IPC server binds to a Linux abstract-namespace Unix socket (\0nuxt-vite-node-<pid>-<ts>.sock). Abstract sockets have no filesystem inode and therefore no permission bits: any local UID on the host that can read /proc/net/unix can enumerate the socket and connect to it.
The IPC server does not perform any peer-credential or shared-secret check before dispatching requests. The module request type… Component: nuxt | Medium | >= 4.0.0, < 4.4.7; >= 3.18.0, < 3.21.7 | 3.21.7, 4.4.7 | Advisory |
| 2026-06-16 | Nuxt: Reflected XSS in <NuxtLink> via unsanitised javascript: or data: URLSummary
<NuxtLink> did not validate the URL scheme of values bound to its to or href props before rendering them into the href attribute of the underlying <a> element. When an application binds attacker-controlled input (a query parameter, a CMS field, a user-supplied profile URL) to <NuxtLink :to> or :href, the attacker can supply a javascript: or vbscript: URL that is reflected verbatim into the rendered markup. Clicking the link executes the supplied script in the origin of the Nuxt appli…
Component: nuxt | Medium | >= 4.0.0, < 4.4.7; >= 3.0.0, < 3.21.7 | 3.21.7, 4.4.7 | CVE-2026-53722 |
| 2026-06-16 | Nuxt: Route-rule middleware bypass via case-sensitivity mismatch between vue-router and the routeRules matcherImpact
Nuxt looks up routeRules for the current navigation by calling
getRouteRules({ path: to.path }) from the page-router plugin and the
no-pages router plugin. The compiled routeRules matcher (built on
rou3) performs case-sensitive matching, while vue-router is configured
with its default sensitive: false and matches paths case-insensitively.
The two routers therefore disagree on which rules apply to a given
request path: vue-router still matches the page record for
/Admin/dashboard, but the `r… Component: nuxt | High | >= 4.0.0, < 4.4.7; >= 3.11.0, < 3.21.7 | 3.21.7, 4.4.7 | CVE-2026-53721 |
| 2026-06-16 | Nuxt: URL-handling weaknesses in navigateTo and reloadNuxtApp: SSR open redirect, client-side script execution via the open option, and protocol-relative bypass in reloadNuxtAppSummary
Three weaknesses in Nuxt’s client-navigation URL handling, all reachable
from documented public APIs (navigateTo and reloadNuxtApp):
- SSR open redirect in
navigateTo via path-normalisation bypass.
navigateTo decided whether a target was external by inspecting the raw
input with hasProtocol(..., { acceptRelative: true }). Inputs such as
/..//evil.com, /.//evil.com, /%2e%2e//evil.com, or
/app/..//evil.com slipped past that check because they start with
/, but WH…
Component: nuxt | Medium | >= 4.0.0, < 4.4.7; >= 3.5.0, < 3.21.7 | 3.21.7, 4.4.7 | CVE-2026-56326 |
| 2026-06-15 | Nuxt: Dev server discloses project absolute path and persistent workspace UUID via /.well-known/appspecific/com.chrome.devtools.jsonSummary
When running nuxt dev, Nuxt registers an unauthenticated route at /.well-known/appspecific/com.chrome.devtools.json that returns the absolute filesystem path of the project root and a per-project UUID persisted to node_modules/.cache/nuxt/chrome-workspace.json. The route is enabled by default via experimental.chromeDevtoolsProjectSettings: true.
The endpoint exists to let Chrome DevTools’ Workspace integration map sources to the developer’s local checkout. The handler is registered directly o… Component: nuxt | Low | >= 4.0.0-alpha.1, < 4.4.7 | 4.4.7 | Advisory |
| 2026-05-29 | Nuxt’s route middleware is not enforced when rendering .server.vue pages via /__nuxt_island/page_*Summary
When experimental.componentIslands is enabled (default in Nuxt 4), any .server.vue file under pages/ is automatically registered as a server island under the key page_<routeName> and exposed via the /__nuxt_island/:name endpoint. Until this fix, requests through that endpoint rendered the page component directly via the SSR renderer without instantiating Vue Router, which meant route middleware declared on the page (including definePageMeta({ middleware })) did not run.
For Nuxt applicati… Component: nuxt | Medium | >= 3.11.0, <= 3.21.5; >= 4.0.0-alpha.1, <= 4.4.5 | 3.21.6, 4.4.6 | CVE-2026-47200 |
| 2026-05-19 | Nuxt: __nuxt_island endpoint does not bind responses to request props, enabling shared-cache poisoningSummary
The /__nuxt_island/* endpoint accepts attacker-controlled props query/body parameters and renders any island component without verifying that the URL-resident hash (<Name>_<hashId>.json) was actually issued for those inputs by <NuxtIsland>. The hash is computed and embedded client-side but never validated server-side, so the same path can return materially different responses depending on the query.
Island components are documented as rendering independently of route context - page middleware… Component: nuxt | Low | >= 3.1.0, <= 3.21.5; >= 4.0.0-alpha.1, <= 4.4.5 | 3.21.6, 4.4.6 | CVE-2026-46342 |
| 2026-05-19 | Nuxt: Reflected XSS in navigateTo() external redirectSummary
navigateTo() with external: true generates a server-side HTML redirect body containing a <meta http-equiv="refresh"> tag. The destination URL is only sanitized by replacing " with %22, leaving <, >, &, and ' unencoded. An attacker who can influence the URL passed to navigateTo(url, { external: true }) can break out of the content="…" attribute and inject arbitrary HTML/JavaScript that executes under the application’s origin.
This is a different root cause from CVE-2024-34343 (GHS… Component: nuxt | Medium | >= 3.4.3, <= 3.21.5; >= 4.0.0-alpha.1, <= 4.4.5 | 3.21.6, 4.4.6 | CVE-2026-45669 |
| 2025-09-17 | Nuxt has Client-Side Path Traversal in Nuxt Island Payload RevivalSummary
A client-side path traversal vulnerability in Nuxt’s Island payload revival mechanism allowed attackers to manipulate client-side requests to different endpoints within the same application domain when specific prerendering conditions are met.
Technical Details
The vulnerability occurs in the client-side payload revival process (revive-payload.client.ts) where Nuxt Islands are automatically fetched when encountering serialized __nuxt_island objects. The issue affects the following flow:
- Du…
Component: nuxt | Low | >= 3.6.0, < 3.19.0; >= 4.0.0, < 4.1.0 | 3.19.0, 4.1.0 | CVE-2025-59414 |
| 2025-03-19 | Nuxt allows DOS via cache poisoning with payload rendering responseSummary
By sending a crafted HTTP request to a server behind an CDN, it is possible in some circumstances to poison the CDN cache and highly impacts the availability of a site.
It is possible to craft a request, such as https://mysite.com/?/_payload.json which will be rendered as JSON. If the CDN in front of a Nuxt site ignores the query string when determining whether to cache a route, then this JSON response could be served to future visitors to the site.
Impact
An attacker can perform this attack… Component: nuxt | High | >= 3.0.0, < 3.16.0 | 3.16.0 | CVE-2025-27415 |
| 2024-08-05 | nuxt vulnerable to Cross-site Scripting in navigateTo if used after SSRSummary
The navigateTo function attempts to blockthe javascript: protocol, but does not correctly use API’s provided by unjs/ufo. This library also contains parsing discrepancies.
Details
The function first tests to see if the specified URL has a protocol. This uses the unjs/ufo package for URL parsing. This function works effectively, and retu… Component: nuxt | Medium | < 3.12.4 | 3.12.4 | CVE-2024-34343 |
| 2024-08-05 | Nuxt vulnerable to remote code execution via the browser when running the test locallySummary
Due to the insufficient validation of the path parameter in the NuxtTestComponentWrapper, an attacker can execute arbitrary JavaScript on the server side, which allows them to execute arbitrary commands.
Details
While running the test, a special component named NuxtTestComponentWrapper is available.
https://github.com/nuxt/nuxt/blob/4779f5906fa4d3c784c2e2d6fe5a5c5f181faaec/packages/nuxt/src/app/components/nuxt-root.vue#L42-L43
This component loads the specified path as a component and renders… Component: nuxt | Critical | >= 3.4.0, < 3.12.4 | 3.12.4 | CVE-2024-34344 |
| 2023-06-13 | nuxt Code Injection vulnerabilityhe Nuxt dev server between versions 3.4.0 and 3.4.3 is vulnerable to code injection when it is exposed publicly. Component: nuxt | Critical | >= 3.4.0, < 3.4.3 | 3.4.3 | CVE-2023-3224 |
