@nuxt/nitro-server (npm)
Advisories
8
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 4.6.3 or later clears every advisory below that has a fix.
Upgrade commands
npm
npm install @nuxt/nitro-server@4.6.3yarn
yarn add @nuxt/nitro-server@4.6.3pnpm
pnpm add @nuxt/nitro-server@4.6.3Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-9v7c-q64q-vv33 Nuxt: Dot segments in the request path bypass `server/middleware` path checks and server route rules on page routes |
Medium EPSS 0.34% |
>= 4.6.0, < 4.6.3 | 4.6.3 |
| GHSA-9v7c-q64q-vv33 Nuxt: Dot segments in the request path bypass `server/middleware` path checks and server route rules on page routes |
Medium EPSS 0.34% |
>= 4.6.0, < 4.6.3 | 4.6.3 |
| GHSA-vjh5-4x84-xrqp Nuxt: Server-side route rules (`redirect`, `headers`, `proxy`, `ssr`) are skipped for case-variant paths when routing is case-insensitive |
Medium EPSS 0.42% |
>= 4.2.0, < 4.6.2 | 4.6.2 |
| GHSA-vjh5-4x84-xrqp Nuxt: Server-side route rules (`redirect`, `headers`, `proxy`, `ssr`) are skipped for case-variant paths when routing is case-insensitive |
Medium EPSS 0.42% |
>= 3.20.0 | No fix yet |
| GHSA-hg3f-28rg-4jxj Nuxt's route middleware is not enforced when rendering `.server.vue` pages via `/__nuxt_island/page_*` |
Medium EPSS 0.23% |
>= 3.20.0, < 3.21.6 | 3.21.6 |
| GHSA-hg3f-28rg-4jxj Nuxt's route middleware is not enforced when rendering `.server.vue` pages via `/__nuxt_island/page_*` |
Medium EPSS 0.23% |
>= 4.2.0, < 4.4.6 | 4.4.6 |
| GHSA-g8wj-3cr3-6w7v Nuxt: `__nuxt_island` endpoint does not bind responses to request props, enabling shared-cache poisoning |
Medium EPSS 0.09% |
>= 3.20.0, < 3.21.6 | 3.21.6 |
| GHSA-g8wj-3cr3-6w7v Nuxt: `__nuxt_island` endpoint does not bind responses to request props, enabling shared-cache poisoning |
Medium EPSS 0.09% |
>= 4.2.0, < 4.4.6 | 4.4.6 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor