Skip to main content
cve.nowby Sazabi
← npm
npmPackage

@nuxt/nitro-server

4 known vulnerabilities (3 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
4 · 3 medium, 1 low
Registry
npm

Advisories 4

  • CVE-2026-119200Medium 6.5

    Nuxt: Dot segments in the request path bypass `server/middleware` path checks and server route rules on page routes

    Affected: from 4.6.0, fixed in 4.6.3.

  • CVE-2026-114132Medium 6.3

    Nuxt: Server-side route rules (`redirect`, `headers`, `proxy`, `ssr`) are skipped for case-variant paths when routing is case-insensitive

    Affected: from 4.2.0, fixed in 4.6.2; from 3.20.0.

  • CVE-2026-47200Medium 6.3

    Nuxt: Route middleware not enforced when rendering `.server.vue` pages via `/__nuxt_island/page_*`

    Affected: from 3.20.0, fixed in 3.21.6; from 4.2.0, fixed in 4.4.6.

  • Nuxt: `__nuxt_island` endpoint does not bind responses to request props, enabling shared-cache poisoning

    Affected: from 3.20.0, fixed in 3.21.6; from 4.2.0, fixed in 4.4.6.