Skip to main content
cve.nowby Sazabi
← npm
npmPackage

nuxt

27 known vulnerabilities (9 high, 14 medium, 4 low), with the versions each affects and the releases that fix them.

Latest release
4.6.4 (Nov 2, 2026): affected by CVE-2026-114132
Newest unaffected release
Every release is affected by at least one advisory
Advisories
27 · 9 high, 14 medium, 4 low
Weekly downloads
3.3M
Dependents
128
Releases
412 since 0.0.1 (Oct 26, 2016)
Registry
npm
Releases read
Nov 8, 2026

Version timeline

  • CVE-2026-119200
    Affects 4.6.0 to 4.6.2 (4.6.3 is outside it)
  • CVE-2026-114133
    Affects 3.13.0 to 4.6.1 (4.6.2 is outside it)
  • CVE-2026-114132
    Affects 3.0.0 to 4.6.4 (through the newest release)
  • CVE-2026-114131
    Affects 3.11.0 to 3.21.2 (3.21.4 is outside it); 4.0.0 to 4.4.2 (4.4.4 is outside it)
  • CVE-2026-114130
    Affects 0.0.1 to 4.5.2 (4.6.0 is outside it)
  • CVE-2026-72744
    Affects 3.21.7 to 3.21.9 (3.21.10 is outside it); 4.4.7 to 4.5.0 (4.5.1 is outside it)
  • CVE-2026-71321
    Affects 3.1.0 to 3.21.9 (3.21.10 is outside it); 4.0.0 to 4.5.0 (4.5.1 is outside it)
  • CVE-2026-71320
    Affects 3.4.0 to 3.21.9 (3.21.10 is outside it); 4.0.0 to 4.5.0 (4.5.1 is outside it)
  • CVE-2026-71318
    Affects 3.1.0 to 3.21.9 (3.21.10 is outside it); 4.0.0 to 4.5.0 (4.5.1 is outside it)
  • CVE-2026-71316
    Affects 4.4.2 to 4.5.0 (4.5.1 is outside it)
  • CVE-2026-71315
    Affects 3.21.7 to 3.21.9 (3.21.10 is outside it); 4.4.7 to 4.5.0 (4.5.1 is outside it)
  • CVE-2026-71314
    Affects 3.1.0 to 3.21.9 (3.21.10 is outside it); 4.0.0 to 4.5.0 (4.5.1 is outside it)
Show all 27 advisoriesShow fewer advisories
  • CVE-2026-56301
    Affects 3.18.0 to 3.21.6 (3.21.7 is outside it); 4.0.0 to 4.4.6 (4.4.7 is outside it)
  • CVE-2026-56698
    Affects 3.5.0 to 3.21.6 (3.21.7 is outside it); 4.0.0 to 4.4.6 (4.4.7 is outside it)
  • CVE-2026-56697
    Affects 3.5.0 to 3.21.6 (3.21.7 is outside it); 4.0.0 to 4.4.6 (4.4.7 is outside it)
  • CVE-2026-56326
    Affects 3.5.0 to 3.21.6 (3.21.7 is outside it); 4.0.0 to 4.4.6 (4.4.7 is outside it)
  • CVE-2026-56317
    Affects 0.0.1 to 3.21.6 (3.21.7 is outside it); 4.0.0 to 4.4.6 (4.4.7 is outside it)
  • CVE-2026-53722
    Affects 3.0.0 to 3.21.6 (3.21.7 is outside it); 4.0.0 to 4.4.6 (4.4.7 is outside it)
  • CVE-2026-53721
    Affects 3.11.0 to 3.21.6 (3.21.7 is outside it); 4.0.0 to 4.4.6 (4.4.7 is outside it)
  • CVE-2026-47200
    Affects 3.11.0 to 3.21.5 (3.21.6 is outside it); 4.0.0-alpha.1 to 4.4.5 (4.4.6 is outside it)
  • CVE-2026-45669
    Affects 3.4.3 to 3.21.5 (3.21.6 is outside it); 4.0.0-alpha.1 to 4.4.5 (4.4.6 is outside it)
  • CVE-2026-46342
    Affects 3.1.0 to 3.21.5 (3.21.6 is outside it); 4.0.0-alpha.1 to 4.4.5 (4.4.6 is outside it)
  • CVE-2025-59414
    Affects 3.6.0 to 3.18.1 (3.19.0 is outside it); 4.0.0 to 4.0.3 (4.1.0 is outside it)
  • CVE-2025-27415
    Affects 3.0.0 to 3.15.4 (3.16.0 is outside it)
  • CVE-2024-34344
    Affects 3.4.0 to 3.12.3 (3.12.4 is outside it)
  • CVE-2024-34343
    Affects 0.0.1 to 3.12.3 (3.12.4 is outside it)
  • CVE-2023-3224
    Affects 3.4.0 to 3.4.2 (3.4.3 is outside it)
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 27

  • CVE-2026-119200Medium 6.5

    Nuxt: Dot segments in the request path bypass `server/middleware` path checks and server route rules on page routes

    Affected: from 4.6.0, fixed in 4.6.3.

    Fixed in 4.6.3 (released Oct 27, 2026, 2 days before disclosure).

    The latest release, 4.6.4, is not affected.

    12% of nuxt downloads last week were affected versions (440.1K).

  • CVE-2026-114133Medium 5.4

    Nuxt server islands render `useHeadSafe` input without sanitisation

    Affected: from 3.13.0, fixed in 4.6.2.

    Fixed in 4.6.2 (released Oct 16, 2026, 5 days before disclosure).

    The latest release, 4.6.4, is not affected.

    60% of nuxt downloads last week were affected versions (2.1M).

  • CVE-2026-114132Medium 6.3

    Nuxt: Server-side route rules (`redirect`, `headers`, `proxy`, `ssr`) are skipped for case-variant paths when routing is case-insensitive

    Affected: from 4.0.0, fixed in 4.6.2; from 3.0.0.

    No fix released. The latest release, 4.6.4, is still affected.

    94% of nuxt downloads last week were affected versions (3.4M).

  • CVE-2026-114131Medium 6.5

    Nuxt: Route rules are matched against the raw request path, so a percent-encoded segment can bypass `appMiddleware` on dynamic and…

    Affected: from 4.0.0, fixed in 4.4.4; from 3.11.0, fixed in 3.21.4.

    Fixed in 3.21.4 (released Apr 29, 2026, 175 days before disclosure) and 4.4.4 (released Apr 29, 2026, 175 days before disclosure).

    The latest release, 4.6.4, is not affected.

    26% of nuxt downloads last week were affected versions (929.3K).

  • Nuxt: Incomplete fix for GHSA-934w-87qh-qr26: a `javascript:` URL prefixed with an ASCII control character executes from `<NuxtLink>` when `pages` is disabled

    Affected: fixed in 4.6.0.

    Fixed in 4.6.0 (released Oct 5, 2026, 16 days before disclosure).

    The latest release, 4.6.4, is not affected.

    65% of nuxt downloads last week were affected versions (2.3M).

  • CVE-2026-72744Medium 6.9

    Nuxt before 4.5.1 Information Disclosure via Chrome DevTools

    Affected: from 4.4.7, fixed in 4.5.1; from 3.21.7, fixed in 3.21.10.

    Fixed in 3.21.10 (released Jul 27, 2026, 15 days before disclosure) and 4.5.1 (released Jul 27, 2026, 15 days before disclosure).

    The latest release, 4.6.4, is not affected.

    6.1% of nuxt downloads last week were affected versions (220.4K).

  • Nuxt: Unauthenticated CPU exhaustion parsing and hashing the Nuxt island endpoint body before hash validation

    Affected: from 4.0.0, fixed in 4.5.1; from 3.1.0, fixed in 3.21.10.

    Fixed in 3.21.10 (released Jul 27, 2026, 9 days before disclosure) and 4.5.1 (released Jul 27, 2026, 9 days before disclosure).

    The latest release, 4.6.4, is not affected.

    36% of nuxt downloads last week were affected versions (1.3M).

  • Nuxt: Server-Side Remote Code Execution via Runtime Template Injection in Nuxt Server Island Props

    Affected: from 4.0.0, fixed in 4.5.1; from 3.4.0, fixed in 3.21.10.

    Fixed in 3.21.10 (released Jul 27, 2026, 9 days before disclosure) and 4.5.1 (released Jul 27, 2026, 9 days before disclosure).

    The latest release, 4.6.4, is not affected.

    36% of nuxt downloads last week were affected versions (1.3M).

  • CVE-2026-71318Medium 4.8

    Nuxt: Unauthorized Component Instantiation via Server Island Props

    Affected: from 4.0.0, fixed in 4.5.1; from 3.1.0, fixed in 3.21.10.

    Fixed in 3.21.10 (released Jul 27, 2026, 9 days before disclosure) and 4.5.1 (released Jul 27, 2026, 9 days before disclosure).

    The latest release, 4.6.4, is not affected.

    36% of nuxt downloads last week were affected versions (1.3M).

  • Nuxt runtime payload cache discloses another user's SSR data across users and to unauthenticated clients

    Affected: from 4.4.0, fixed in 4.5.1.

    Fixed in 4.5.1 (released Jul 27, 2026, 9 days before disclosure).

    The latest release, 4.6.4, is not affected.

    9.4% of nuxt downloads last week were affected versions (336.3K).

  • Nuxt route rules silently dropped for mixed-case paths, bypassing appMiddleware auth gates (incomplete fix for CVE-2026-53721)

    Affected: from 4.4.7, fixed in 4.5.1; from 3.21.7, fixed in 3.21.10.

    Fixed in 3.21.10 (released Jul 27, 2026, 9 days before disclosure) and 4.5.1 (released Jul 27, 2026, 9 days before disclosure).

    The latest release, 4.6.4, is not affected.

    6.1% of nuxt downloads last week were affected versions (220.4K).

  • Nuxt: Unauthenticated out-of-memory crash via unbounded v-for expansion in island rendering

    Affected: from 4.0.0, fixed in 4.5.1; from 3.1.0, fixed in 3.21.10.

    Fixed in 3.21.10 (released Jul 27, 2026, 9 days before disclosure) and 4.5.1 (released Jul 27, 2026, 9 days before disclosure).

    The latest release, 4.6.4, is not affected.

    36% of nuxt downloads last week were affected versions (1.3M).

  • CVE-2026-56301Medium 6.8

    Nuxt - Arbitrary File Read via World-Connectable vite-node IPC Socket on Linux

    Affected: from 4.0.0, fixed in 4.4.7; from 3.18.0, fixed in 3.21.7.

    Fixed in 3.21.7 (released Jun 2, 2026, 21 days before disclosure) and 4.4.7 (released Jun 2, 2026, 21 days before disclosure).

    The latest release, 4.6.4, is not affected.

    21% of nuxt downloads last week were affected versions (741.7K).

  • CVE-2026-56698Medium 5.3

    Nuxt - Cross-Site Scripting via navigateTo open Option

    Affected: from 4.0.0, fixed in 4.4.7; from 3.5.0, fixed in 3.21.7.

    Fixed in 3.21.7 (released Jun 2, 2026, 20 days before disclosure) and 4.4.7 (released Jun 2, 2026, 20 days before disclosure).

    The latest release, 4.6.4, is not affected.

    30% of nuxt downloads last week were affected versions (1.1M).

  • CVE-2026-56697Medium 5.3

    Nuxt - Open Redirect via Protocol-Relative Paths in reloadNuxtApp

    Affected: from 4.0.0, fixed in 4.4.7; from 3.5.0, fixed in 3.21.7.

    Fixed in 3.21.7 (released Jun 2, 2026, 20 days before disclosure) and 4.4.7 (released Jun 2, 2026, 20 days before disclosure).

    The latest release, 4.6.4, is not affected.

    30% of nuxt downloads last week were affected versions (1.1M).

Show all 27 advisoriesShow fewer advisories
  • CVE-2026-56326Medium 5.3

    Nuxt - Server-Side Open Redirect via Path-Normalization Bypass in navigateTo

    Affected: from 4.0.0, fixed in 4.4.7; from 3.5.0, fixed in 3.21.7.

    Fixed in 3.21.7 (released Jun 2, 2026, 20 days before disclosure) and 4.4.7 (released Jun 2, 2026, 20 days before disclosure).

    The latest release, 4.6.4, is not affected.

    30% of nuxt downloads last week were affected versions (1.1M).

  • Nuxt - Cross-Site Scripting via NoScript Component Slot Content

    Affected: from 4.0.0, fixed in 4.4.7; fixed in 3.21.7.

    Fixed in 3.21.7 (released Jun 2, 2026, 18 days before disclosure) and 4.4.7 (released Jun 2, 2026, 18 days before disclosure).

    The latest release, 4.6.4, is not affected.

    36% of nuxt downloads last week were affected versions (1.3M).

  • CVE-2026-53722Medium 5.1

    Nuxt: Reflected XSS in `<NuxtLink>` via unsanitised `javascript:` or `data:` URL

    Affected: from 4.0.0, fixed in 4.4.7; from 3.0.0, fixed in 3.21.7.

    Fixed in 3.21.7 (released Jun 2, 2026, 10 days before disclosure) and 4.4.7 (released Jun 2, 2026, 10 days before disclosure).

    The latest release, 4.6.4, is not affected.

    30% of nuxt downloads last week were affected versions (1.1M).

  • Nuxt: Route-rule middleware bypass via case-sensitivity mismatch between vue-router and the routeRules matcher

    Affected: from 4.0.0, fixed in 4.4.7; from 3.11.0, fixed in 3.21.7.

    Fixed in 3.21.7 (released Jun 2, 2026, 10 days before disclosure) and 4.4.7 (released Jun 2, 2026, 10 days before disclosure).

    The latest release, 4.6.4, is not affected.

    29% of nuxt downloads last week were affected versions (1M).

  • CVE-2026-47200Medium 6.3

    Nuxt: Route middleware not enforced when rendering `.server.vue` pages via `/__nuxt_island/page_*`

    Affected: from 3.11.0, fixed in 3.21.6; from 4.0.0-alpha.1, fixed in 4.4.6.

    Fixed in 3.21.6 (released May 18, 2026, 25 days before disclosure) and 4.4.6 (released May 18, 2026, 25 days before disclosure).

    The latest release, 4.6.4, is not affected.

    27% of nuxt downloads last week were affected versions (974K).

  • CVE-2026-45669Medium 5.3

    Nuxt: Reflected XSS in `navigateTo()` external redirect

    Affected: from 3.4.3, fixed in 3.21.6; from 4.0.0-alpha.1, fixed in 4.4.6.

    Fixed in 3.21.6 (released May 18, 2026, 25 days before disclosure) and 4.4.6 (released May 18, 2026, 25 days before disclosure).

    The latest release, 4.6.4, is not affected.

    28% of nuxt downloads last week were affected versions (1M).

  • Nuxt: `__nuxt_island` endpoint does not bind responses to request props, enabling shared-cache poisoning

    Affected: from 3.1.0, fixed in 3.21.6; from 4.0.0-alpha.1, fixed in 4.4.6.

    Fixed in 3.21.6 (released May 18, 2026, 25 days before disclosure) and 4.4.6 (released May 18, 2026, 25 days before disclosure).

    The latest release, 4.6.4, is not affected.

    29% of nuxt downloads last week were affected versions (1M).

  • Nuxt Client-Side Path Traversal in Nuxt Island Payload Revival

    Affected: from 3.6.0, fixed in 3.19.0; from 4.0.0, fixed in 4.1.0.

    Fixed in 3.19.0 (released Sep 2, 2025, 15 days before disclosure) and 4.1.0 (released Sep 2, 2025, 15 days before disclosure).

    The latest release, 4.6.4, is not affected.

    10% of nuxt downloads last week were affected versions (369.1K).

  • Nuxt allows DOS via cache poisoning with payload rendering response

    Affected: from 3.0.0, fixed in 3.16.0.

    Fixed in 3.16.0 (released Mar 7, 2025, 12 days before disclosure).

    The latest release, 4.6.4, is not affected.

    6.1% of nuxt downloads last week were affected versions (220.4K).

  • Remote code execution via the browser when running the test locally in nuxt

    Affected: from 3.4.0, fixed in 3.12.4.

    Fixed in 3.12.4 (released Jul 18, 2024, 18 days before disclosure).

    The latest release, 4.6.4, is not affected.

    2.1% of nuxt downloads last week were affected versions (75.8K).

  • CVE-2024-34343Medium 6.3

    Cross-site Scripting (XSS) in navigateTo if used after SSR in nuxt

    Affected: fixed in 3.12.4.

    Fixed in 3.12.4 (released Jul 18, 2024, 18 days before disclosure).

    The latest release, 4.6.4, is not affected.

    8.5% of nuxt downloads last week were affected versions (304.9K).

  • Code Injection in nuxt/nuxt

    Affected: from 3.4.0, fixed in 3.4.3.

    Fixed in 3.4.3 (released Apr 28, 2023, 46 days before disclosure).

    The latest release, 4.6.4, is not affected.

    <0.1% of nuxt downloads last week were affected versions (2K).