# nuxt (npm) vulnerabilities 27 known vulnerabilities (9 high, 14 medium, 4 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 4.6.4 (Nov 2, 2026): affected by CVE-2026-114132 - Newest unaffected release: Every release is affected by at least one advisory - Weekly downloads: 3.3M - Dependents: 128 - Releases: 412 since 0.0.1 (Oct 26, 2016) - Registry: https://www.npmjs.com/package/nuxt - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-119200: 4.6.0 to 4.6.2 (4.6.3 is outside it) - CVE-2026-114133: 3.13.0 to 4.6.1 (4.6.2 is outside it) - CVE-2026-114132: 3.0.0 to 4.6.4 (through the newest release) - CVE-2026-114131: 3.11.0 to 3.21.2 (3.21.4 is outside it); 4.0.0 to 4.4.2 (4.4.4 is outside it) - CVE-2026-114130: 0.0.1 to 4.5.2 (4.6.0 is outside it) - CVE-2026-72744: 3.21.7 to 3.21.9 (3.21.10 is outside it); 4.4.7 to 4.5.0 (4.5.1 is outside it) - CVE-2026-71321: 3.1.0 to 3.21.9 (3.21.10 is outside it); 4.0.0 to 4.5.0 (4.5.1 is outside it) - CVE-2026-71320: 3.4.0 to 3.21.9 (3.21.10 is outside it); 4.0.0 to 4.5.0 (4.5.1 is outside it) - CVE-2026-71318: 3.1.0 to 3.21.9 (3.21.10 is outside it); 4.0.0 to 4.5.0 (4.5.1 is outside it) - CVE-2026-71316: 4.4.2 to 4.5.0 (4.5.1 is outside it) - CVE-2026-71315: 3.21.7 to 3.21.9 (3.21.10 is outside it); 4.4.7 to 4.5.0 (4.5.1 is outside it) - CVE-2026-71314: 3.1.0 to 3.21.9 (3.21.10 is outside it); 4.0.0 to 4.5.0 (4.5.1 is outside it) - CVE-2026-56301: 3.18.0 to 3.21.6 (3.21.7 is outside it); 4.0.0 to 4.4.6 (4.4.7 is outside it) - CVE-2026-56698: 3.5.0 to 3.21.6 (3.21.7 is outside it); 4.0.0 to 4.4.6 (4.4.7 is outside it) - CVE-2026-56697: 3.5.0 to 3.21.6 (3.21.7 is outside it); 4.0.0 to 4.4.6 (4.4.7 is outside it) - CVE-2026-56326: 3.5.0 to 3.21.6 (3.21.7 is outside it); 4.0.0 to 4.4.6 (4.4.7 is outside it) - CVE-2026-56317: 0.0.1 to 3.21.6 (3.21.7 is outside it); 4.0.0 to 4.4.6 (4.4.7 is outside it) - CVE-2026-53722: 3.0.0 to 3.21.6 (3.21.7 is outside it); 4.0.0 to 4.4.6 (4.4.7 is outside it) - CVE-2026-53721: 3.11.0 to 3.21.6 (3.21.7 is outside it); 4.0.0 to 4.4.6 (4.4.7 is outside it) - CVE-2026-47200: 3.11.0 to 3.21.5 (3.21.6 is outside it); 4.0.0-alpha.1 to 4.4.5 (4.4.6 is outside it) - CVE-2026-45669: 3.4.3 to 3.21.5 (3.21.6 is outside it); 4.0.0-alpha.1 to 4.4.5 (4.4.6 is outside it) - CVE-2026-46342: 3.1.0 to 3.21.5 (3.21.6 is outside it); 4.0.0-alpha.1 to 4.4.5 (4.4.6 is outside it) - CVE-2025-59414: 3.6.0 to 3.18.1 (3.19.0 is outside it); 4.0.0 to 4.0.3 (4.1.0 is outside it) - CVE-2025-27415: 3.0.0 to 3.15.4 (3.16.0 is outside it) - CVE-2024-34344: 3.4.0 to 3.12.3 (3.12.4 is outside it) - CVE-2024-34343: 0.0.1 to 3.12.3 (3.12.4 is outside it) - CVE-2023-3224: 3.4.0 to 3.4.2 (3.4.3 is outside it) ## Advisories (27) ### [CVE-2026-119200](https://cve.now/CVE-2026-119200): Nuxt: Dot segments in the request path bypass \`server/middleware\` path checks and server route rules on page routes - Severity: Medium 6.5 - Published: Oct 29, 2026 - Affected: from 4.6.0, fixed in 4.6.3. - Fixed in 4.6.3 (released Oct 27, 2026, 2 days before disclosure). - The latest release, 4.6.4, is not affected. - 12% of nuxt downloads last week were affected versions (440.1K). ### [CVE-2026-114133](https://cve.now/CVE-2026-114133): Nuxt server islands render \`useHeadSafe\` input without sanitisation - Severity: Medium 5.4 - Published: Oct 21, 2026 - Affected: from 3.13.0, fixed in 4.6.2. - Fixed in 4.6.2 (released Oct 16, 2026, 5 days before disclosure). - The latest release, 4.6.4, is not affected. - 60% of nuxt downloads last week were affected versions (2.1M). ### [CVE-2026-114132](https://cve.now/CVE-2026-114132): Nuxt: Server-side route rules (\`redirect\`, \`headers\`, \`proxy\`, \`ssr\`) are skipped for case-variant paths when routing is case-insensitive - Severity: Medium 6.3 - Published: Oct 21, 2026 - Affected: from 4.0.0, fixed in 4.6.2; from 3.0.0. - No fix released. The latest release, 4.6.4, is still affected. - 94% of nuxt downloads last week were affected versions (3.4M). ### [CVE-2026-114131](https://cve.now/CVE-2026-114131): Nuxt: Route rules are matched against the raw request path, so a percent-encoded segment can bypass \`appMiddleware\` on dynamic and… - Severity: Medium 6.5 - Published: Oct 21, 2026 - Affected: from 4.0.0, fixed in 4.4.4; from 3.11.0, fixed in 3.21.4. - Fixed in 3.21.4 (released Apr 29, 2026, 175 days before disclosure) and 4.4.4 (released Apr 29, 2026, 175 days before disclosure). - The latest release, 4.6.4, is not affected. - 26% of nuxt downloads last week were affected versions (929.3K). ### [CVE-2026-114130](https://cve.now/CVE-2026-114130): Nuxt: Incomplete fix for GHSA-934w-87qh-qr26: a \`javascript:\` URL prefixed with an ASCII control character executes from \`\\` when \`pages\` is disabled - Severity: Low 2.3 - Published: Oct 21, 2026 - Affected: fixed in 4.6.0. - Fixed in 4.6.0 (released Oct 5, 2026, 16 days before disclosure). - The latest release, 4.6.4, is not affected. - 65% of nuxt downloads last week were affected versions (2.3M). ### [CVE-2026-72744](https://cve.now/CVE-2026-72744): Nuxt before 4.5.1 Information Disclosure via Chrome DevTools - Severity: Medium 6.9 - Published: Aug 11, 2026 - Affected: from 4.4.7, fixed in 4.5.1; from 3.21.7, fixed in 3.21.10. - Fixed in 3.21.10 (released Jul 27, 2026, 15 days before disclosure) and 4.5.1 (released Jul 27, 2026, 15 days before disclosure). - The latest release, 4.6.4, is not affected. - 6.1% of nuxt downloads last week were affected versions (220.4K). ### [CVE-2026-71321](https://cve.now/CVE-2026-71321): Nuxt: Unauthenticated CPU exhaustion parsing and hashing the Nuxt island endpoint body before hash validation - Severity: High 7.5 - Published: Aug 5, 2026 - Affected: from 4.0.0, fixed in 4.5.1; from 3.1.0, fixed in 3.21.10. - Fixed in 3.21.10 (released Jul 27, 2026, 9 days before disclosure) and 4.5.1 (released Jul 27, 2026, 9 days before disclosure). - The latest release, 4.6.4, is not affected. - 36% of nuxt downloads last week were affected versions (1.3M). ### [CVE-2026-71320](https://cve.now/CVE-2026-71320): Nuxt: Server-Side Remote Code Execution via Runtime Template Injection in Nuxt Server Island Props - Severity: High 8.1 - Published: Aug 5, 2026 - Affected: from 4.0.0, fixed in 4.5.1; from 3.4.0, fixed in 3.21.10. - Fixed in 3.21.10 (released Jul 27, 2026, 9 days before disclosure) and 4.5.1 (released Jul 27, 2026, 9 days before disclosure). - The latest release, 4.6.4, is not affected. - 36% of nuxt downloads last week were affected versions (1.3M). ### [CVE-2026-71318](https://cve.now/CVE-2026-71318): Nuxt: Unauthorized Component Instantiation via Server Island Props - Severity: Medium 4.8 - Published: Aug 5, 2026 - Affected: from 4.0.0, fixed in 4.5.1; from 3.1.0, fixed in 3.21.10. - Fixed in 3.21.10 (released Jul 27, 2026, 9 days before disclosure) and 4.5.1 (released Jul 27, 2026, 9 days before disclosure). - The latest release, 4.6.4, is not affected. - 36% of nuxt downloads last week were affected versions (1.3M). ### [CVE-2026-71316](https://cve.now/CVE-2026-71316): Nuxt runtime payload cache discloses another user's SSR data across users and to unauthenticated clients - Severity: High 7.5 - Published: Aug 5, 2026 - Affected: from 4.4.0, fixed in 4.5.1. - Fixed in 4.5.1 (released Jul 27, 2026, 9 days before disclosure). - The latest release, 4.6.4, is not affected. - 9.4% of nuxt downloads last week were affected versions (336.3K). ### [CVE-2026-71315](https://cve.now/CVE-2026-71315): Nuxt route rules silently dropped for mixed-case paths, bypassing appMiddleware auth gates (incomplete fix for CVE-2026-53721) - Severity: High 8.2 - Published: Aug 5, 2026 - Affected: from 4.4.7, fixed in 4.5.1; from 3.21.7, fixed in 3.21.10. - Fixed in 3.21.10 (released Jul 27, 2026, 9 days before disclosure) and 4.5.1 (released Jul 27, 2026, 9 days before disclosure). - The latest release, 4.6.4, is not affected. - 6.1% of nuxt downloads last week were affected versions (220.4K). ### [CVE-2026-71314](https://cve.now/CVE-2026-71314): Nuxt: Unauthenticated out-of-memory crash via unbounded v-for expansion in island rendering - Severity: High 7.5 - Published: Aug 5, 2026 - Affected: from 4.0.0, fixed in 4.5.1; from 3.1.0, fixed in 3.21.10. - Fixed in 3.21.10 (released Jul 27, 2026, 9 days before disclosure) and 4.5.1 (released Jul 27, 2026, 9 days before disclosure). - The latest release, 4.6.4, is not affected. - 36% of nuxt downloads last week were affected versions (1.3M). ### [CVE-2026-56301](https://cve.now/CVE-2026-56301): Nuxt - Arbitrary File Read via World-Connectable vite-node IPC Socket on Linux - Severity: Medium 6.8 - Published: Jun 23, 2026 - Affected: from 4.0.0, fixed in 4.4.7; from 3.18.0, fixed in 3.21.7. - Fixed in 3.21.7 (released Jun 2, 2026, 21 days before disclosure) and 4.4.7 (released Jun 2, 2026, 21 days before disclosure). - The latest release, 4.6.4, is not affected. - 21% of nuxt downloads last week were affected versions (741.7K). ### [CVE-2026-56698](https://cve.now/CVE-2026-56698): Nuxt - Cross-Site Scripting via navigateTo open Option - Severity: Medium 5.3 - Published: Jun 22, 2026 - Affected: from 4.0.0, fixed in 4.4.7; from 3.5.0, fixed in 3.21.7. - Fixed in 3.21.7 (released Jun 2, 2026, 20 days before disclosure) and 4.4.7 (released Jun 2, 2026, 20 days before disclosure). - The latest release, 4.6.4, is not affected. - 30% of nuxt downloads last week were affected versions (1.1M). ### [CVE-2026-56697](https://cve.now/CVE-2026-56697): Nuxt - Open Redirect via Protocol-Relative Paths in reloadNuxtApp - Severity: Medium 5.3 - Published: Jun 22, 2026 - Affected: from 4.0.0, fixed in 4.4.7; from 3.5.0, fixed in 3.21.7. - Fixed in 3.21.7 (released Jun 2, 2026, 20 days before disclosure) and 4.4.7 (released Jun 2, 2026, 20 days before disclosure). - The latest release, 4.6.4, is not affected. - 30% of nuxt downloads last week were affected versions (1.1M). ### [CVE-2026-56326](https://cve.now/CVE-2026-56326): Nuxt - Server-Side Open Redirect via Path-Normalization Bypass in navigateTo - Severity: Medium 5.3 - Published: Jun 22, 2026 - Affected: from 4.0.0, fixed in 4.4.7; from 3.5.0, fixed in 3.21.7. - Fixed in 3.21.7 (released Jun 2, 2026, 20 days before disclosure) and 4.4.7 (released Jun 2, 2026, 20 days before disclosure). - The latest release, 4.6.4, is not affected. - 30% of nuxt downloads last week were affected versions (1.1M). ### [CVE-2026-56317](https://cve.now/CVE-2026-56317): Nuxt - Cross-Site Scripting via NoScript Component Slot Content - Severity: Low 2.3 - Published: Jun 20, 2026 - Affected: from 4.0.0, fixed in 4.4.7; fixed in 3.21.7. - Fixed in 3.21.7 (released Jun 2, 2026, 18 days before disclosure) and 4.4.7 (released Jun 2, 2026, 18 days before disclosure). - The latest release, 4.6.4, is not affected. - 36% of nuxt downloads last week were affected versions (1.3M). ### [CVE-2026-53722](https://cve.now/CVE-2026-53722): Nuxt: Reflected XSS in \`\\` via unsanitised \`javascript:\` or \`data:\` URL - Severity: Medium 5.1 - Published: Jun 12, 2026 - Affected: from 4.0.0, fixed in 4.4.7; from 3.0.0, fixed in 3.21.7. - Fixed in 3.21.7 (released Jun 2, 2026, 10 days before disclosure) and 4.4.7 (released Jun 2, 2026, 10 days before disclosure). - The latest release, 4.6.4, is not affected. - 30% of nuxt downloads last week were affected versions (1.1M). ### [CVE-2026-53721](https://cve.now/CVE-2026-53721): Nuxt: Route-rule middleware bypass via case-sensitivity mismatch between vue-router and the routeRules matcher - Severity: High 8.8 - Published: Jun 12, 2026 - Affected: from 4.0.0, fixed in 4.4.7; from 3.11.0, fixed in 3.21.7. - Fixed in 3.21.7 (released Jun 2, 2026, 10 days before disclosure) and 4.4.7 (released Jun 2, 2026, 10 days before disclosure). - The latest release, 4.6.4, is not affected. - 29% of nuxt downloads last week were affected versions (1M). ### [CVE-2026-47200](https://cve.now/CVE-2026-47200): Nuxt: Route middleware not enforced when rendering \`.server.vue\` pages via \`/\_\_nuxt\_island/page\_\*\` - Severity: Medium 6.3 - Published: Jun 12, 2026 - Affected: from 3.11.0, fixed in 3.21.6; from 4.0.0-alpha.1, fixed in 4.4.6. - Fixed in 3.21.6 (released May 18, 2026, 25 days before disclosure) and 4.4.6 (released May 18, 2026, 25 days before disclosure). - The latest release, 4.6.4, is not affected. - 27% of nuxt downloads last week were affected versions (974K). ### [CVE-2026-45669](https://cve.now/CVE-2026-45669): Nuxt: Reflected XSS in \`navigateTo()\` external redirect - Severity: Medium 5.3 - Published: Jun 12, 2026 - Affected: from 3.4.3, fixed in 3.21.6; from 4.0.0-alpha.1, fixed in 4.4.6. - Fixed in 3.21.6 (released May 18, 2026, 25 days before disclosure) and 4.4.6 (released May 18, 2026, 25 days before disclosure). - The latest release, 4.6.4, is not affected. - 28% of nuxt downloads last week were affected versions (1M). ### [CVE-2026-46342](https://cve.now/CVE-2026-46342): Nuxt: \`\_\_nuxt\_island\` endpoint does not bind responses to request props, enabling shared-cache poisoning - Severity: Low 2.3 - Published: Jun 12, 2026 - Affected: from 3.1.0, fixed in 3.21.6; from 4.0.0-alpha.1, fixed in 4.4.6. - Fixed in 3.21.6 (released May 18, 2026, 25 days before disclosure) and 4.4.6 (released May 18, 2026, 25 days before disclosure). - The latest release, 4.6.4, is not affected. - 29% of nuxt downloads last week were affected versions (1M). ### [CVE-2025-59414](https://cve.now/CVE-2025-59414): Nuxt Client-Side Path Traversal in Nuxt Island Payload Revival - Severity: Low 3.1 - Published: Sep 17, 2025 - Affected: from 3.6.0, fixed in 3.19.0; from 4.0.0, fixed in 4.1.0. - Fixed in 3.19.0 (released Sep 2, 2025, 15 days before disclosure) and 4.1.0 (released Sep 2, 2025, 15 days before disclosure). - The latest release, 4.6.4, is not affected. - 10% of nuxt downloads last week were affected versions (369.1K). ### [CVE-2025-27415](https://cve.now/CVE-2025-27415): Nuxt allows DOS via cache poisoning with payload rendering response - Severity: High 7.5 - Published: Mar 19, 2025 - Affected: from 3.0.0, fixed in 3.16.0. - Fixed in 3.16.0 (released Mar 7, 2025, 12 days before disclosure). - The latest release, 4.6.4, is not affected. - 6.1% of nuxt downloads last week were affected versions (220.4K). ### [CVE-2024-34344](https://cve.now/CVE-2024-34344): Remote code execution via the browser when running the test locally in nuxt - Severity: High 8.8 - Published: Aug 5, 2024 - Affected: from 3.4.0, fixed in 3.12.4. - Fixed in 3.12.4 (released Jul 18, 2024, 18 days before disclosure). - The latest release, 4.6.4, is not affected. - 2.1% of nuxt downloads last week were affected versions (75.8K). ### [CVE-2024-34343](https://cve.now/CVE-2024-34343): Cross-site Scripting (XSS) in navigateTo if used after SSR in nuxt - Severity: Medium 6.3 - Published: Aug 5, 2024 - Affected: fixed in 3.12.4. - Fixed in 3.12.4 (released Jul 18, 2024, 18 days before disclosure). - The latest release, 4.6.4, is not affected. - 8.5% of nuxt downloads last week were affected versions (304.9K). ### [CVE-2023-3224](https://cve.now/CVE-2023-3224): Code Injection in nuxt/nuxt - Severity: High 8.1 - Published: Jun 13, 2023 - Affected: from 3.4.0, fixed in 3.4.3. - Fixed in 3.4.3 (released Apr 28, 2023, 46 days before disclosure). - The latest release, 4.6.4, is not affected. - <0.1% of nuxt downloads last week were affected versions (2K). --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/npm/nuxt Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.