NU
Product
nuxt
37
CVEs
0
On KEV
9.8
Max CVSS
8
New 30D
Severity mix
Critical 1High 10Medium 24Low 2
Watch
Add nuxt to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-119200 New | 6.5 | Oct 29 | Nuxt: Dot segments in the request path bypass `server/middleware` path checks and server route rules on page routes Affected: >= 4.6.0, < 4.6.3 |
| CVE-2026-114131 | 6.5 | Oct 21 | Nuxt: Route rules are matched against the raw request path, so a percent-encoded segment can bypass `appMiddleware` on dynamic and catch-all routes Affected: >= 4.0.0, < 4.4.4; >= 3.11.0, < 3.21.4 |
| CVE-2026-114132 | 6.3 | Oct 21 | Nuxt: Server-side route rules (`redirect`, `headers`, `proxy`, `ssr`) are skipped for case-variant paths when routing is case-insensitive Affected: < 4.6.2 |
| CVE-2026-72744 | 6.2 | Aug 11 | Nuxt before 4.5.1 Information Disclosure via Chrome DevTools Affected: 4.4.7 before 4.5.1; 3.21.7 before 3.21.10 |
| CVE-2026-56698 | 6.1 | Jun 22 | Nuxt - Cross-Site Scripting via navigateTo open Option Affected: 4.0.0 before 4.4.7; before 3.21.7 |
| CVE-2026-56697 | 6.1 | Jun 22 | Nuxt - Open Redirect via Protocol-Relative Paths in reloadNuxtApp Affected: 4.0.0 before 4.4.7; before 3.21.7 |
| CVE-2026-56326 | 6.1 | Jun 22 | Nuxt - Server-Side Open Redirect via Path-Normalization Bypass in navigateTo Affected: 4.0.0 before 4.4.7; before 3.21.7 |
| CVE-2026-56317 | 6.1 | Jun 20 | Nuxt - Cross-Site Scripting via NoScript Component Slot Content Affected: 4.0.0 before 4.4.7; before 3.21.7 |
| CVE-2024-34343 | 6.1 | Aug 5 | Cross-site Scripting (XSS) in navigateTo if used after SSR in nuxt Affected: < 3.12.4 |
| CVE-2023-0878 | 6.1 | Feb 17 | Cross-site Scripting (XSS) - Generic in nuxt/framework Affected: after 3.0.0 before 3.2.1; 3.0.0; 3.0.0; 3.0.0 |
| CVE-2026-119199 New | 5.9 | Oct 29 | Nuxt dev server exposes private runtime config through the Nitro dev bundle Affected: >= 3.0.0, < 4.6.3 |
| CVE-2026-119198 New | 5.9 | Oct 29 | Nuxt dev server arbitrary file read through client error reports Affected: >= 4.6.0, < 4.6.3 |
| CVE-2026-49993 | 5.7 | Jun 12 | @nuxt/webpack-builder and @nuxt/rspack-builder dev server same-origin check bypassed when Sec-Fetch-Site, Origin, and Referer are all absent (incomplete fix for GHSA-6m52-m754-pw2g) Affected: >= 3.15.4, < 3.21.7; >= 4.0.0, < 4.4.7 |
| CVE-2026-56301 | 5.5 | Jun 23 | Nuxt - Arbitrary File Read via World-Connectable vite-node IPC Socket on Linux Affected: 4.0.0 before 4.4.7; 3.18.0 before 3.21.7 |
| CVE-2026-114133 | 5.4 | Oct 21 | Nuxt server islands render `useHeadSafe` input without sanitisation Affected: >= 3.13.0, < 4.6.2 |
| CVE-2026-53722 | 5.4 | Jun 12 | Nuxt: Reflected XSS in `<NuxtLink>` via unsanitised `javascript:` or `data:` URL Affected: < 3.21.7; >= 4.0.0, < 4.4.7 |
| CVE-2026-45669 | 5.4 | Jun 12 | Nuxt: Reflected XSS in `navigateTo()` external redirect Affected: >= 3.4.3, < 3.21.6; >= 4.0.0-alpha.1, < 4.4.6 |
| CVE-2026-45670 | 5.4 | Jun 12 | Nuxt: Dev server exposes built source over LAN to malicious sites (incomplete fix for GHSA-4gf7-ff8x-hq99) Affected: >= 3.15.4, < 3.21.6; >= 4.0.0-alpha.1, < 4.4.6 |
| CVE-2026-46342 | 5.4 | Jun 12 | Nuxt: `__nuxt_island` endpoint does not bind responses to request props, enabling shared-cache poisoning Affected: >= 3.1.0, < 3.21.6; >= 4.0.0-alpha.1, < 4.4.6 |
| CVE-2026-47200 | 5.3 | Jun 12 | Nuxt: Route middleware not enforced when rendering `.server.vue` pages via `/__nuxt_island/page_*` Affected: >= 3.11.0, < 3.21.6; >= 4.0.0-alpha.1, < 4.4.6 |
| CVE-2025-24361 | 5.3 | Jan 25 | Opening a malicious website while running a Nuxt dev server could allow read-only access to code Affected: >= 3.0.0, < 3.15.3; >= 3.12.2, < 3.15.3 |
| CVE-2025-24360 | 5.3 | Jan 25 | Opening a malicious website while running a Nuxt dev server could allow read-only access to code Affected: >= 3.8.1, < 3.15.3 |
| CVE-2026-119201 New | 4.8 | Oct 29 | Nuxt dev server exposes generated appSecret through Vite file serving Affected: >= 4.6.0, < 4.6.3 |
| CVE-2026-71318 | 4.8 | Aug 5 | Nuxt: Unauthorized Component Instantiation via Server Island Props Affected: >= 4.0.0, < 4.5.1; >= 3.1.0, < 3.21.10 |
Showing 24