nuxt (npm)
Advisories
48
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 4.6.3 or later clears every advisory below that has a fix.
Upgrade commands
npm
npm install nuxt@4.6.3yarn
yarn add nuxt@4.6.3pnpm
pnpm add nuxt@4.6.3Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-9v7c-q64q-vv33 Nuxt: Dot segments in the request path bypass `server/middleware` path checks and server route rules on page routes |
Medium EPSS 0.34% |
>= 4.6.0, < 4.6.3 | 4.6.3 |
| GHSA-9v7c-q64q-vv33 Nuxt: Dot segments in the request path bypass `server/middleware` path checks and server route rules on page routes |
Medium EPSS 0.34% |
>= 4.6.0, < 4.6.3 | 4.6.3 |
| GHSA-xfq5-w38q-pc2x Nuxt server islands render `useHeadSafe` input without sanitisation |
Medium EPSS 0.22% |
>= 3.13.0, < 4.6.2 | 4.6.2 |
| GHSA-vjh5-4x84-xrqp Nuxt: Server-side route rules (`redirect`, `headers`, `proxy`, `ssr`) are skipped for case-variant paths when routing is case-insensitive |
Medium EPSS 0.42% |
>= 3.0.0 | No fix yet |
| GHSA-vjh5-4x84-xrqp Nuxt: Server-side route rules (`redirect`, `headers`, `proxy`, `ssr`) are skipped for case-variant paths when routing is case-insensitive |
Medium EPSS 0.42% |
>= 4.0.0, < 4.6.2 | 4.6.2 |
| GHSA-6gq8-jgmh-3ffp Nuxt: Route rules are matched against the raw request path, so a percent-encoded segment can bypass `appMiddleware` on dynamic and catch-all routes |
Medium EPSS 0.36% |
>= 4.0.0, < 4.4.4 | 4.4.4 |
| GHSA-6gq8-jgmh-3ffp Nuxt: Route rules are matched against the raw request path, so a percent-encoded segment can bypass `appMiddleware` on dynamic and catch-all routes |
Medium EPSS 0.36% |
>= 3.11.0, < 3.21.4 | 3.21.4 |
| GHSA-jjm6-p2m9-9w4x Nuxt: Incomplete fix for GHSA-934w-87qh-qr26: a `javascript:` URL prefixed with an ASCII control character executes from `<NuxtLink>` when `pages` is disabled |
Low EPSS 0.41% |
< 4.6.0 | 4.6.0 |
| GHSA-4jjw-pwvw-q6w3 Duplicate Advisory: Nuxt dev server discloses project root and workspace UUID via the Chrome DevTools workspace endpoint Withdrawn |
Medium | >= 4.4.7 | No fix yet |
| GHSA-7c4v-fwgw-9rf7 Nuxt dev server discloses project root and workspace UUID via the Chrome DevTools workspace endpoint |
Medium EPSS 0.18% |
>= 3.21.7, < 3.21.10 | 3.21.10 |
| GHSA-7c4v-fwgw-9rf7 Nuxt dev server discloses project root and workspace UUID via the Chrome DevTools workspace endpoint |
Medium EPSS 0.18% |
>= 4.4.7, < 4.5.1 | 4.5.1 |
| GHSA-9pgf-384g-p7mv Nuxt: Unauthenticated CPU exhaustion parsing and hashing the Nuxt island endpoint body before hash validation |
High EPSS 0.74% |
>= 3.1.0, < 3.21.10 | 3.21.10 |
| GHSA-9pgf-384g-p7mv Nuxt: Unauthenticated CPU exhaustion parsing and hashing the Nuxt island endpoint body before hash validation |
High EPSS 0.74% |
>= 4.0.0, < 4.5.1 | 4.5.1 |
| GHSA-9473-5f9j-94wq Nuxt: Server-Side Remote Code Execution via Runtime Template Injection in Nuxt Server Island Props |
High EPSS 0.71% |
>= 4.0.0, < 4.5.1 | 4.5.1 |
| GHSA-9473-5f9j-94wq Nuxt: Server-Side Remote Code Execution via Runtime Template Injection in Nuxt Server Island Props |
High EPSS 0.71% |
>= 3.4.0, < 3.21.10 | 3.21.10 |
| GHSA-48hr-524c-v5w3 Nuxt: Unauthorized Component Instantiation via Server Island Props |
Medium EPSS 0.32% |
>= 3.1.0, < 3.21.10 | 3.21.10 |
| GHSA-48hr-524c-v5w3 Nuxt: Unauthorized Component Instantiation via Server Island Props |
Medium EPSS 0.32% |
>= 4.0.0, < 4.5.1 | 4.5.1 |
| GHSA-wm8w-6qjm-cv43 Nuxt runtime payload cache discloses another user's SSR data across users and to unauthenticated clients |
High EPSS 0.51% |
>= 4.4.0, < 4.5.1 | 4.5.1 |
| GHSA-hxvh-4h3w-prp9 Nuxt route rules silently dropped for mixed-case paths, bypassing appMiddleware auth gates (incomplete fix for CVE-2026-53721) |
High EPSS 0.47% |
>= 3.21.7, < 3.21.10 | 3.21.10 |
| GHSA-hxvh-4h3w-prp9 Nuxt route rules silently dropped for mixed-case paths, bypassing appMiddleware auth gates (incomplete fix for CVE-2026-53721) |
High EPSS 0.47% |
>= 4.4.7, < 4.5.1 | 4.5.1 |
| GHSA-hxcr-hm88-mpq6 Nuxt: Unauthenticated out-of-memory crash via unbounded v-for expansion in island rendering |
High EPSS 0.91% |
>= 4.0.0, < 4.5.1 | 4.5.1 |
| GHSA-hxcr-hm88-mpq6 Nuxt: Unauthenticated out-of-memory crash via unbounded v-for expansion in island rendering |
High EPSS 0.91% |
>= 3.1.0, < 3.21.10 | 3.21.10 |
| GHSA-2x6f-57hp-86fx Duplicate Advisory: Nuxt dev server vite-node IPC socket is world-connectable on Linux Withdrawn |
Medium | >= 4.0.0, < 4.4.7 | 4.4.7 |
| GHSA-xppm-jmw6-fhmf Duplicate Advisory: Cross-site scripting via <NoScript> slot content in Nuxt's head components Withdrawn |
Low | >= 4.0.0, < 4.4.7 | 4.4.7 |
| GHSA-xppm-jmw6-fhmf Duplicate Advisory: Cross-site scripting via <NoScript> slot content in Nuxt's head components Withdrawn |
Low | < 3.21.7 | 3.21.7 |
| GHSA-m3q2-p4fw-w38m Cross-site scripting via <NoScript> slot content in Nuxt's head components |
Medium EPSS 0.34% |
< 3.21.7 | 3.21.7 |
| GHSA-m3q2-p4fw-w38m Cross-site scripting via <NoScript> slot content in Nuxt's head components |
Medium EPSS 0.34% |
>= 4.0.0, < 4.4.7 | 4.4.7 |
| GHSA-534h-c3cw-v3h9 Nuxt dev server vite-node IPC socket is world-connectable on Linux |
Medium EPSS 0.15% |
>= 4.0.0, < 4.4.7 | 4.4.7 |
| GHSA-534h-c3cw-v3h9 Nuxt dev server vite-node IPC socket is world-connectable on Linux |
Medium EPSS 0.15% |
>= 3.18.0, < 3.21.7 | 3.21.7 |
| GHSA-c9cv-mq2m-ppp3 Nuxt: URL-handling weaknesses in `navigateTo` and `reloadNuxtApp`: SSR open redirect, client-side script execution via the `open` option, and protocol-relative bypass in `reloadNuxtApp` |
Medium EPSS 0.41% |
>= 3.5.0, < 3.21.7 | 3.21.7 |
| GHSA-c9cv-mq2m-ppp3 Nuxt: URL-handling weaknesses in `navigateTo` and `reloadNuxtApp`: SSR open redirect, client-side script execution via the `open` option, and protocol-relative bypass in `reloadNuxtApp` |
Medium EPSS 0.41% |
>= 4.0.0, < 4.4.7 | 4.4.7 |
| GHSA-rq7w-g337-39qq Nuxt: Dev server discloses project absolute path and persistent workspace UUID via `/.well-known/appspecific/com.chrome.devtools.json` |
Low | >= 4.0.0-alpha.1, < 4.4.7 | 4.4.7 |
| GHSA-934w-87qh-qr26 Nuxt: Reflected XSS in `<NuxtLink>` via unsanitised `javascript:` or `data:` URL |
Medium EPSS 0.29% |
>= 3.0.0, < 3.21.7 | 3.21.7 |
| GHSA-934w-87qh-qr26 Nuxt: Reflected XSS in `<NuxtLink>` via unsanitised `javascript:` or `data:` URL |
Medium EPSS 0.29% |
>= 4.0.0, < 4.4.7 | 4.4.7 |
| GHSA-mm7m-92g8-7m47 Nuxt: Route-rule middleware bypass via case-sensitivity mismatch between vue-router and the routeRules matcher |
High EPSS 0.40% |
>= 3.11.0, < 3.21.7 | 3.21.7 |
| GHSA-mm7m-92g8-7m47 Nuxt: Route-rule middleware bypass via case-sensitivity mismatch between vue-router and the routeRules matcher |
High EPSS 0.40% |
>= 4.0.0, < 4.4.7 | 4.4.7 |
| GHSA-hg3f-28rg-4jxj Nuxt's route middleware is not enforced when rendering `.server.vue` pages via `/__nuxt_island/page_*` |
Medium EPSS 0.23% |
>= 4.0.0-alpha.1, < 4.4.6 | 4.4.6 |
| GHSA-hg3f-28rg-4jxj Nuxt's route middleware is not enforced when rendering `.server.vue` pages via `/__nuxt_island/page_*` |
Medium EPSS 0.23% |
>= 3.11.0, < 3.21.6 | 3.21.6 |
| GHSA-g8wj-3cr3-6w7v Nuxt: `__nuxt_island` endpoint does not bind responses to request props, enabling shared-cache poisoning |
Medium EPSS 0.09% |
>= 4.0.0-alpha.1, < 4.4.6 | 4.4.6 |
| GHSA-g8wj-3cr3-6w7v Nuxt: `__nuxt_island` endpoint does not bind responses to request props, enabling shared-cache poisoning |
Medium EPSS 0.09% |
>= 3.1.0, < 3.21.6 | 3.21.6 |
| GHSA-fx6j-w5w5-h468 Nuxt: Reflected XSS in `navigateTo()` external redirect |
Medium EPSS 0.18% |
>= 3.4.3, < 3.21.6 | 3.21.6 |
| GHSA-fx6j-w5w5-h468 Nuxt: Reflected XSS in `navigateTo()` external redirect |
Medium EPSS 0.18% |
>= 4.0.0-alpha.1, < 4.4.6 | 4.4.6 |
| GHSA-p6jq-8vc4-79f6 Nuxt has Client-Side Path Traversal in Nuxt Island Payload Revival |
Low EPSS 0.37% |
>= 4.0.0, < 4.1.0 | 4.1.0 |
| GHSA-p6jq-8vc4-79f6 Nuxt has Client-Side Path Traversal in Nuxt Island Payload Revival |
Low EPSS 0.37% |
>= 3.6.0, < 3.19.0 | 3.19.0 |
| GHSA-jvhm-gjrh-3h93 Nuxt allows DOS via cache poisoning with payload rendering response |
High EPSS 0.39% |
>= 3.0.0, < 3.16.0 | 3.16.0 |
| GHSA-v784-fjjh-f8r4 Nuxt vulnerable to remote code execution via the browser when running the test locally |
High EPSS 0.83% |
>= 3.4.0, < 3.12.4 | 3.12.4 |
| GHSA-vf6r-87q4-2vjf nuxt vulnerable to Cross-site Scripting in navigateTo if used after SSR |
Medium EPSS 0.44% |
< 3.12.4 | 3.12.4 |
| GHSA-gc34-5v43-h7v8 nuxt Code Injection vulnerability |
Critical EPSS 58.65% |
>= 3.4.0, < 3.4.3 | 3.4.3 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor