Code Injection in nuxt/nuxt

Remote code execution via the browser when running the test locally in nuxt

Path Traversal: '../filedir' in Nuxt Devtools

Nuxt route rules silently dropped for mixed-case paths, bypassing appMiddleware auth gates (incomplete fix for CVE-2026-53721)

Nuxt: Route-rule middleware bypass via case-sensitivity mismatch between vue-router and the routeRules matcher

Nuxt: Server-Side Remote Code Execution via Runtime Template Injection in Nuxt Server Island Props

Nuxt: Unauthenticated CPU exhaustion parsing and hashing the Nuxt island endpoint body before hash validation

Nuxt runtime payload cache discloses another user's SSR data across users and to unauthenticated clients

Nuxt: Unauthenticated out-of-memory crash via unbounded v-for expansion in island rendering

Nuxt allows DOS via cache poisoning with payload rendering response

Server-Side Request Forgery (SSRF) in nuxt-icon

Nuxt: Dot segments in the request path bypass `server/middleware` path checks and server route rules on page routes

Nuxt: Route rules are matched against the raw request path, so a percent-encoded segment can bypass `appMiddleware` on dynamic and catch-all routes

Nuxt: Server-side route rules (`redirect`, `headers`, `proxy`, `ssr`) are skipped for case-variant paths when routing is case-insensitive

Nuxt before 4.5.1 Information Disclosure via Chrome DevTools

Nuxt - Cross-Site Scripting via navigateTo open Option

Nuxt - Open Redirect via Protocol-Relative Paths in reloadNuxtApp

Nuxt - Server-Side Open Redirect via Path-Normalization Bypass in navigateTo

Nuxt - Cross-Site Scripting via NoScript Component Slot Content

Cross-site Scripting (XSS) in navigateTo if used after SSR in nuxt

Cross-site Scripting (XSS) - Generic in nuxt/framework

Nuxt dev server exposes private runtime config through the Nitro dev bundle

Nuxt dev server arbitrary file read through client error reports

@nuxt/webpack-builder and @nuxt/rspack-builder dev server same-origin check bypassed when Sec-Fetch-Site, Origin, and Referer are all absent (incomplete fix for GHSA-6m52-m754-pw2g)

Nuxt - Arbitrary File Read via World-Connectable vite-node IPC Socket on Linux

Nuxt server islands render `useHeadSafe` input without sanitisation

Nuxt: Reflected XSS in `<NuxtLink>` via unsanitised `javascript:` or `data:` URL

Nuxt: Reflected XSS in `navigateTo()` external redirect

Nuxt: Dev server exposes built source over LAN to malicious sites (incomplete fix for GHSA-4gf7-ff8x-hq99)

Nuxt: `__nuxt_island` endpoint does not bind responses to request props, enabling shared-cache poisoning

Nuxt: Route middleware not enforced when rendering `.server.vue` pages via `/__nuxt_island/page_*`

Opening a malicious website while running a Nuxt dev server could allow read-only access to code

Opening a malicious website while running a Nuxt dev server could allow read-only access to code

Nuxt dev server exposes generated appSecret through Vite file serving

Nuxt: Unauthorized Component Instantiation via Server Island Props

Nuxt Client-Side Path Traversal in Nuxt Island Payload Revival

Nuxt: Incomplete fix for GHSA-934w-87qh-qr26: a `javascript:` URL prefixed with an ASCII control character executes from `<NuxtLink>` when `pages` is disabled