Nuxt vulnerabilities
43 CVEs and advisories name Nuxt as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-46342Nuxt: `__nuxt_island` endpoint does not bind responses to request props, enabling shared-cache poisoning
- CVE-2025-59414Nuxt Client-Side Path Traversal in Nuxt Island Payload Revival
- CVE-2025-27415Nuxt allows DOS via cache poisoning with payload rendering response
- CVE-2025-24361Opening a malicious website while running a Nuxt dev server could allow read-only access to code
- CVE-2025-24360Opening a malicious website while running a Nuxt dev server could allow read-only access to code
- CVE-2024-42352Server-Side Request Forgery (SSRF) in nuxt-icon
- CVE-2024-34344Remote code execution via the browser when running the test locally in nuxt
- CVE-2024-34343Cross-site Scripting (XSS) in navigateTo if used after SSR in nuxt
- CVE-2024-23657Path Traversal: '../filedir' in Nuxt Devtools
- CVE-2023-3224Code Injection in nuxt/nuxt
- CVE-2023-0878Cross-site Scripting (XSS) - Generic in nuxt/framework
- CVE-2022-4414Cross-site Scripting (XSS) - DOM in nuxt/framework
- CVE-2022-4413Cross-site Scripting (XSS) - Reflected in nuxt/framework