Login Request a demo
NU
Vendor
nuxt
11 products with CVEs on record
55
CVEs
0
On KEV
9
New 30D
Products
NU
nuxt
nuxt
9.8
37 CVEs0 on KEV8 new
NI
nitro-server
@nuxt
6.5
1 CVEs0 on KEV1 new
NU
nuxt/framework
nuxt
6.1
3 CVEs0 on KEV0 new
DE
devtools
nuxt
9.6
2 CVEs0 on KEV0 new
FR
Framework
Nuxt
6.1
2 CVEs0 on KEV0 new
NU
Nuxt/nitro-server
Nuxt
5.4
2 CVEs0 on KEV0 new
NU
Nuxt/rspack-builder
Nuxt
5.7
2 CVEs0 on KEV0 new
NU
Nuxt/webpack-builder
Nuxt
5.7
2 CVEs0 on KEV0 new
OI
OG Image
Nuxt
7.5
2 CVEs0 on KEV0 new
IC
icon
nuxt
7.5
1 CVEs0 on KEV0 new
NU
nuxt/nuxt
nuxt
9.8
1 CVEs0 on KEV0 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2026-119201
New
NU
nuxt
nuxt
4.8–Oct 29Nuxt dev server exposes generated appSecret through Vite file serving
CVE-2026-119200
New
NU
nuxt
nuxt
6.5–Oct 29Nuxt: Dot segments in the request path bypass `server/middleware` path checks and server route rules on page routes
CVE-2026-119199
New
NU
nuxt
nuxt
5.9–Oct 29Nuxt dev server exposes private runtime config through the Nitro dev bundle
CVE-2026-119198
New
NU
nuxt
nuxt
5.9–Oct 29Nuxt dev server arbitrary file read through client error reports
CVE-2026-114133
NU
nuxt
nuxt
5.4
0%
Oct 21Nuxt server islands render `useHeadSafe` input without sanitisation
CVE-2026-114132
NU
nuxt
nuxt
6.3
0%
Oct 21Nuxt: Server-side route rules (`redirect`, `headers`, `proxy`, `ssr`) are skipped for case-variant paths when routing is case-insensitive
CVE-2026-114131
NU
nuxt
nuxt
6.5
0%
Oct 21Nuxt: Route rules are matched against the raw request path, so a percent-encoded segment can bypass `appMiddleware` on dynamic and catch-all routes
CVE-2026-114130
NU
nuxt
nuxt
2.3
0%
Oct 21Nuxt: Incomplete fix for GHSA-934w-87qh-qr26: a `javascript:` URL prefixed with an ASCII control character executes from `<NuxtLink>` when `pages` is disabled
CVE-2026-72744
NU
nuxt
nuxt
6.2
0%
Aug 11Nuxt before 4.5.1 Information Disclosure via Chrome DevTools
CVE-2026-71321
NU
nuxt
nuxt
7.5
1%
Aug 5Nuxt: Unauthenticated CPU exhaustion parsing and hashing the Nuxt island endpoint body before hash validation
CVE-2026-71320
NU
nuxt
nuxt
8.1
1%
Aug 5Nuxt: Server-Side Remote Code Execution via Runtime Template Injection in Nuxt Server Island Props
CVE-2026-71319
DE
devtools
nuxt
9.6
1%
Aug 5Nuxt.js Unauthenticated WebSocket RPC Call Leading to Remote Code Execution
CVE-2026-71318
NU
nuxt
nuxt
4.8
0%
Aug 5Nuxt: Unauthorized Component Instantiation via Server Island Props
CVE-2026-71316
NU
nuxt
nuxt
7.5
1%
Aug 5Nuxt runtime payload cache discloses another user's SSR data across users and to unauthenticated clients
CVE-2026-71315
NU
nuxt
nuxt
8.2
0%
Aug 5Nuxt route rules silently dropped for mixed-case paths, bypassing appMiddleware auth gates (incomplete fix for CVE-2026-53721)
CVE-2026-71314
NU
nuxt
nuxt
7.5
1%
Aug 5Nuxt: Unauthenticated out-of-memory crash via unbounded v-for expansion in island rendering
CVE-2026-56301
NU
Nuxt
Nuxt
5.5
0%
Jun 23Nuxt - Arbitrary File Read via World-Connectable vite-node IPC Socket on Linux
CVE-2026-56698
NU
Nuxt
Nuxt
6.1
0%
Jun 22Nuxt - Cross-Site Scripting via navigateTo open Option
CVE-2026-56697
NU
Nuxt
Nuxt
6.1
0%
Jun 22Nuxt - Open Redirect via Protocol-Relative Paths in reloadNuxtApp
CVE-2026-56326
NU
Nuxt
Nuxt
6.1
0%
Jun 22Nuxt - Server-Side Open Redirect via Path-Normalization Bypass in navigateTo
CVE-2026-56317
NU
Nuxt
Nuxt
6.1
0%
Jun 20Nuxt - Cross-Site Scripting via NoScript Component Slot Content
CVE-2026-53722
NU
nuxt
nuxt
5.4
0%
Jun 12Nuxt: Reflected XSS in `<NuxtLink>` via unsanitised `javascript:` or `data:` URL
CVE-2026-53721
NU
nuxt
nuxt
8.2
0%
Jun 12Nuxt: Route-rule middleware bypass via case-sensitivity mismatch between vue-router and the routeRules matcher
CVE-2026-47200
NU
nuxt
nuxt
5.3
0%
Jun 12Nuxt: Route middleware not enforced when rendering `.server.vue` pages via `/__nuxt_island/page_*`
CVE-2026-49993
NU
nuxt
nuxt
5.7
0%
Jun 12@nuxt/webpack-builder and @nuxt/rspack-builder dev server same-origin check bypassed when Sec-Fetch-Site, Origin, and Referer are all absent (incomplete fix for GHSA-6m52-m754-pw2g)
CVE-2026-45669
NU
nuxt
nuxt
5.4
0%
Jun 12Nuxt: Reflected XSS in `navigateTo()` external redirect
CVE-2026-45670
NU
nuxt
nuxt
5.4
0%
Jun 12Nuxt: Dev server exposes built source over LAN to malicious sites (incomplete fix for GHSA-4gf7-ff8x-hq99)
CVE-2026-46342
NU
nuxt
nuxt
5.4
0%
Jun 12Nuxt: `__nuxt_island` endpoint does not bind responses to request props, enabling shared-cache poisoning
CVE-2026-34405
OI
OG Image
Nuxt
6.1
0%
Mar 31Nuxt OG Image vulnerable to reflected XSS via query parameter injection into HTML attributes
CVE-2026-34404
OI
OG Image
Nuxt
7.5
0%
Mar 31Nuxt OG Image vulnerable to DoS via image generation
CVE-2025-52662
DE
Devtools
Nuxt
6.1
0%
Nov 7A vulnerability in Nuxt DevTools has been fixed in version **2.6.4***
CVE-2025-59414
NU
nuxt
nuxt
3.1
0%
Sep 17Nuxt Client-Side Path Traversal in Nuxt Island Payload Revival
CVE-2025-27415
NU
nuxt
nuxt
7.5
0%
Mar 19Nuxt allows DOS via cache poisoning with payload rendering response
CVE-2025-24361
NU
nuxt
nuxt
5.3
0%
Jan 25Opening a malicious website while running a Nuxt dev server could allow read-only access to code
CVE-2025-24360
NU
nuxt
nuxt
5.3
1%
Jan 25Opening a malicious website while running a Nuxt dev server could allow read-only access to code
CVE-2024-42352
IC
icon
nuxt
7.5
1%
Aug 5Server-Side Request Forgery (SSRF) in nuxt-icon
CVE-2024-34344
NU
nuxt
nuxt
8.8
1%
Aug 5Remote code execution via the browser when running the test locally in nuxt
CVE-2024-34343
NU
nuxt
nuxt
6.1
0%
Aug 5Cross-site Scripting (XSS) in navigateTo if used after SSR in nuxt
CVE-2024-23657
NU
nuxt
nuxt
8.8
1%
Aug 5Path Traversal: '../filedir' in Nuxt Devtools
CVE-2023-3224
NU
nuxt/nuxt
nuxt
9.8
59%
Jun 13Code Injection in nuxt/nuxt
CVE-2023-0878
NU
nuxt/framework
nuxt
6.1
1%
Feb 17Cross-site Scripting (XSS) - Generic in nuxt/framework
CVE-2022-4414
NU
nuxt/framework
nuxt
6.1
0%
Dec 11Cross-site Scripting (XSS) - DOM in nuxt/framework
CVE-2022-4413
NU
nuxt/framework
nuxt
6.1
1%
Dec 11Cross-site Scripting (XSS) - Reflected in nuxt/framework