Nuxt vulnerabilities
43 CVEs and advisories name Nuxt as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-123808Nuxt UI: UAuthForm / UForm SSR markup omits `method`, leaking credentials via GET if submitted before hydration
- CVE-2026-102650Nuxt Content: Unauthenticated SQLite Function DoS via Content Query API
- CVE-2026-120309Nuxt 4.6.0 before 4.6.2 Route Param Confusion via getRouterParam
- CVE-2026-119201Nuxt dev server exposes generated appSecret through Vite file serving
- CVE-2026-119200Nuxt: Dot segments in the request path bypass `server/middleware` path checks and server route rules on page routes
- CVE-2026-119199Nuxt dev server exposes private runtime config through the Nitro dev bundle
- CVE-2026-119198Nuxt dev server arbitrary file read through client error reports
- CVE-2026-114133Nuxt server islands render `useHeadSafe` input without sanitisation
- CVE-2026-114132Nuxt: Server-side route rules (`redirect`, `headers`, `proxy`, `ssr`) are skipped for case-variant paths when routing is case-insensitive
- CVE-2026-114131Nuxt: Route rules are matched against the raw request path, so a percent-encoded segment can bypass `appMiddleware` on dynamic and…
- CVE-2026-114130Nuxt: Incomplete fix for GHSA-934w-87qh-qr26: a `javascript:` URL prefixed with an ASCII control character executes from `<NuxtLink>` when `pages` is disabled
- CVE-2026-72744Nuxt before 4.5.1 Information Disclosure via Chrome DevTools
- CVE-2026-71321Nuxt: Unauthenticated CPU exhaustion parsing and hashing the Nuxt island endpoint body before hash validation
- CVE-2026-71320Nuxt: Server-Side Remote Code Execution via Runtime Template Injection in Nuxt Server Island Props
- CVE-2026-71319Nuxt.js Unauthenticated WebSocket RPC Call Leading to Remote Code Execution
- CVE-2026-71318Nuxt: Unauthorized Component Instantiation via Server Island Props
- CVE-2026-71316Nuxt runtime payload cache discloses another user's SSR data across users and to unauthenticated clients
- CVE-2026-71315Nuxt route rules silently dropped for mixed-case paths, bypassing appMiddleware auth gates (incomplete fix for CVE-2026-53721)
- CVE-2026-71314Nuxt: Unauthenticated out-of-memory crash via unbounded v-for expansion in island rendering
- CVE-2026-56301Nuxt - Arbitrary File Read via World-Connectable vite-node IPC Socket on Linux
- CVE-2026-56698Nuxt - Cross-Site Scripting via navigateTo open Option
- CVE-2026-56697Nuxt - Open Redirect via Protocol-Relative Paths in reloadNuxtApp
- CVE-2026-56326Nuxt - Server-Side Open Redirect via Path-Normalization Bypass in navigateTo
- CVE-2026-56317Nuxt - Cross-Site Scripting via NoScript Component Slot Content
- CVE-2026-53722Nuxt: Reflected XSS in `<NuxtLink>` via unsanitised `javascript:` or `data:` URL
- CVE-2026-53721Nuxt: Route-rule middleware bypass via case-sensitivity mismatch between vue-router and the routeRules matcher
- CVE-2026-47200Nuxt: Route middleware not enforced when rendering `.server.vue` pages via `/__nuxt_island/page_*`
- CVE-2026-49993@nuxt/webpack-builder and @nuxt/rspack-builder dev server same-origin check bypassed when Sec-Fetch-Site, Origin, and Referer are all absent (incomplete fix for GHSA-6m52-m754-pw2g)
- CVE-2026-45669Nuxt: Reflected XSS in `navigateTo()` external redirect
- CVE-2026-45670Nuxt: Dev server exposes built source over LAN to malicious sites (incomplete fix for GHSA-4gf7-ff8x-hq99)