# cve.now: Nuxt The newest entries naming Nuxt as an affected vendor (up to 200), of 43 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md. - [CVE-2026-123808](https://cve.now/CVE-2026-123808.md): Nuxt UI: UAuthForm / UForm SSR markup omits \`method\`, leaking credentials via GET if submitted before hydration (CVSS 5.3) - [CVE-2026-102650](https://cve.now/CVE-2026-102650.md): Nuxt Content: Unauthenticated SQLite Function DoS via Content Query API (CVSS 7.5) - [CVE-2026-120309](https://cve.now/CVE-2026-120309.md): Nuxt 4.6.0 before 4.6.2 Route Param Confusion via getRouterParam (CVSS 6.3) - [CVE-2026-119201](https://cve.now/CVE-2026-119201.md): Nuxt dev server exposes generated appSecret through Vite file serving (CVSS 4.8) - [CVE-2026-119200](https://cve.now/CVE-2026-119200.md): Nuxt: Dot segments in the request path bypass \`server/middleware\` path checks and server route rules on page routes (CVSS 6.5) - [CVE-2026-119199](https://cve.now/CVE-2026-119199.md): Nuxt dev server exposes private runtime config through the Nitro dev bundle (CVSS 5.9) - [CVE-2026-119198](https://cve.now/CVE-2026-119198.md): Nuxt dev server arbitrary file read through client error reports (CVSS 5.9) - [CVE-2026-114133](https://cve.now/CVE-2026-114133.md): Nuxt server islands render \`useHeadSafe\` input without sanitisation (CVSS 5.4) - [CVE-2026-114132](https://cve.now/CVE-2026-114132.md): Nuxt: Server-side route rules (\`redirect\`, \`headers\`, \`proxy\`, \`ssr\`) are skipped for case-variant paths when routing is case-insensitive (CVSS 6.3) - [CVE-2026-114131](https://cve.now/CVE-2026-114131.md): Nuxt: Route rules are matched against the raw request path, so a percent-encoded segment can bypass \`appMiddleware\` on dynamic and… (CVSS 6.5) - [CVE-2026-114130](https://cve.now/CVE-2026-114130.md): Nuxt: Incomplete fix for GHSA-934w-87qh-qr26: a \`javascript:\` URL prefixed with an ASCII control character executes from \`\\` when \`pages\` is disabled (CVSS 2.3) - [CVE-2026-72744](https://cve.now/CVE-2026-72744.md): Nuxt before 4.5.1 Information Disclosure via Chrome DevTools (CVSS 6.9) - [CVE-2026-71321](https://cve.now/CVE-2026-71321.md): Nuxt: Unauthenticated CPU exhaustion parsing and hashing the Nuxt island endpoint body before hash validation (CVSS 7.5) - [CVE-2026-71320](https://cve.now/CVE-2026-71320.md): Nuxt: Server-Side Remote Code Execution via Runtime Template Injection in Nuxt Server Island Props (CVSS 8.1) - [CVE-2026-71319](https://cve.now/CVE-2026-71319.md): Nuxt.js Unauthenticated WebSocket RPC Call Leading to Remote Code Execution (CVSS 9.6) - [CVE-2026-71318](https://cve.now/CVE-2026-71318.md): Nuxt: Unauthorized Component Instantiation via Server Island Props (CVSS 4.8) - [CVE-2026-71316](https://cve.now/CVE-2026-71316.md): Nuxt runtime payload cache discloses another user's SSR data across users and to unauthenticated clients (CVSS 7.5) - [CVE-2026-71315](https://cve.now/CVE-2026-71315.md): Nuxt route rules silently dropped for mixed-case paths, bypassing appMiddleware auth gates (incomplete fix for CVE-2026-53721) (CVSS 8.2) - [CVE-2026-71314](https://cve.now/CVE-2026-71314.md): Nuxt: Unauthenticated out-of-memory crash via unbounded v-for expansion in island rendering (CVSS 7.5) - [CVE-2026-56301](https://cve.now/CVE-2026-56301.md): Nuxt - Arbitrary File Read via World-Connectable vite-node IPC Socket on Linux (CVSS 6.8) - [CVE-2026-56698](https://cve.now/CVE-2026-56698.md): Nuxt - Cross-Site Scripting via navigateTo open Option (CVSS 5.3) - [CVE-2026-56697](https://cve.now/CVE-2026-56697.md): Nuxt - Open Redirect via Protocol-Relative Paths in reloadNuxtApp (CVSS 5.3) - [CVE-2026-56326](https://cve.now/CVE-2026-56326.md): Nuxt - Server-Side Open Redirect via Path-Normalization Bypass in navigateTo (CVSS 5.3) - [CVE-2026-56317](https://cve.now/CVE-2026-56317.md): Nuxt - Cross-Site Scripting via NoScript Component Slot Content (CVSS 2.3) - [CVE-2026-53722](https://cve.now/CVE-2026-53722.md): Nuxt: Reflected XSS in \`\\` via unsanitised \`javascript:\` or \`data:\` URL (CVSS 5.1) - [CVE-2026-53721](https://cve.now/CVE-2026-53721.md): Nuxt: Route-rule middleware bypass via case-sensitivity mismatch between vue-router and the routeRules matcher (CVSS 8.8) - [CVE-2026-47200](https://cve.now/CVE-2026-47200.md): Nuxt: Route middleware not enforced when rendering \`.server.vue\` pages via \`/\_\_nuxt\_island/page\_\*\` (CVSS 6.3) - [CVE-2026-49993](https://cve.now/CVE-2026-49993.md): @nuxt/webpack-builder and @nuxt/rspack-builder dev server same-origin check bypassed when Sec-Fetch-Site, Origin, and Referer are all absent (incomplete fix for GHSA-6m52-m754-pw2g) (CVSS 5.9) - [CVE-2026-45669](https://cve.now/CVE-2026-45669.md): Nuxt: Reflected XSS in \`navigateTo()\` external redirect (CVSS 5.3) - [CVE-2026-45670](https://cve.now/CVE-2026-45670.md): Nuxt: Dev server exposes built source over LAN to malicious sites (incomplete fix for GHSA-4gf7-ff8x-hq99) (CVSS 5.9) - [CVE-2026-46342](https://cve.now/CVE-2026-46342.md): Nuxt: \`\_\_nuxt\_island\` endpoint does not bind responses to request props, enabling shared-cache poisoning (CVSS 2.3) - [CVE-2025-59414](https://cve.now/CVE-2025-59414.md): Nuxt Client-Side Path Traversal in Nuxt Island Payload Revival (CVSS 3.1) - [CVE-2025-27415](https://cve.now/CVE-2025-27415.md): Nuxt allows DOS via cache poisoning with payload rendering response (CVSS 7.5) - [CVE-2025-24361](https://cve.now/CVE-2025-24361.md): Opening a malicious website while running a Nuxt dev server could allow read-only access to code (CVSS 5.3) - [CVE-2025-24360](https://cve.now/CVE-2025-24360.md): Opening a malicious website while running a Nuxt dev server could allow read-only access to code (CVSS 5.3) - [CVE-2024-42352](https://cve.now/CVE-2024-42352.md): Server-Side Request Forgery (SSRF) in nuxt-icon (CVSS 8.6) - [CVE-2024-34344](https://cve.now/CVE-2024-34344.md): Remote code execution via the browser when running the test locally in nuxt (CVSS 8.8) - [CVE-2024-34343](https://cve.now/CVE-2024-34343.md): Cross-site Scripting (XSS) in navigateTo if used after SSR in nuxt (CVSS 6.3) - [CVE-2024-23657](https://cve.now/CVE-2024-23657.md): Path Traversal: '../filedir' in Nuxt Devtools (CVSS 8.8) - [CVE-2023-3224](https://cve.now/CVE-2023-3224.md): Code Injection in nuxt/nuxt (CVSS 8.1) - [CVE-2023-0878](https://cve.now/CVE-2023-0878.md): Cross-site Scripting (XSS) - Generic in nuxt/framework (CVSS 6.1) - [CVE-2022-4414](https://cve.now/CVE-2022-4414.md): Cross-site Scripting (XSS) - DOM in nuxt/framework (CVSS 6.1) - [CVE-2022-4413](https://cve.now/CVE-2022-4413.md): Cross-site Scripting (XSS) - Reflected in nuxt/framework (CVSS 6.1) --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/vendors/nuxt Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.