By vendor

Nuxt vulnerabilities

Known CVEs affecting Nuxt products, prioritized by severity, with SEC.co remediation and detection guidance.

12 published vulnerabilities

• CVE-2026-53721HIGH 8.2

  Nuxt, a popular Vue.js web framework, contains a middleware bypass vulnerability caused by inconsistent case-sensitivity handling between its router and route-rule matcher. An attacker can craft requests with different letter casing to bypass security middleware that should be protecting sensitive routes, potentially exposing functionality that was intended to be restricted. This affects Nuxt versions 3.11.0 through 3.21.6 and 4.0.0 through 4.4.6. Patches are available in versions 3.21.7 and 4.4.7.

• CVE-2026-56317MEDIUM 6.1

  Nuxt, a popular Vue.js framework, has a cross-site scripting (XSS) vulnerability in its NoScript component. When developers use the NoScript component to render untrusted data—such as user-supplied query parameters—the framework writes that content directly to the DOM without sanitizing it. An attacker can craft a malicious URL containing JavaScript that executes in the victim's browser when they visit the page, potentially stealing session tokens, modifying page content, or redirecting users to phishing sites.

• CVE-2026-56326MEDIUM 6.1

  Nuxt, a popular JavaScript framework for building web applications, contains a vulnerability in its `navigateTo` function that can be tricked into redirecting users to attacker-controlled websites. The vulnerability affects Nuxt 4.0.0 through 4.4.6 and all 3.x versions before 3.21.7. Attackers exploit this by crafting specially formatted URLs that bypass the framework's validation of external redirect targets, allowing them to send victims to phishing sites or steal authentication tokens. The attack requires user interaction—a victim must click a malicious link—but is otherwise straightforward to execute.

• CVE-2026-56697MEDIUM 6.1

  Nuxt, a popular web framework, has a vulnerability in its `reloadNuxtApp` function that allows attackers to trick users into visiting malicious websites. The flaw stems from how the function validates URLs—it checks whether a path starts with a script protocol (like `javascript:`), but protocol-relative URLs (those beginning with `//`) slip through this check. When a user-supplied path like `//evil.com` is processed, the browser resolves it using the current page's protocol (http or https), redirecting to the attacker's domain instead. This enables phishing attacks or theft of sensitive authorization codes from OAuth flows. Affected versions are Nuxt 4.0.0 through 4.4.6 and all 3.x versions before 3.21.7.

• CVE-2026-56698MEDIUM 6.1

  Nuxt, a popular JavaScript framework, has a security flaw in its navigateTo function that fails to block certain types of links when users can control where they navigate. If an attacker tricks a user into clicking a specially crafted link or can inject malicious input into the navigation destination, the attacker's JavaScript code executes within the legitimate application's security context. This affects Nuxt 4.0.0 through 4.4.6 and all 3.x versions before 3.21.7. The vulnerability requires user interaction and is rated as medium severity because the impact is limited to information disclosure and minor manipulation within the page, though it can affect multiple users if hosted on shared origins.

• CVE-2026-49993MEDIUM 5.7

  Nuxt's build tools (rspack-builder and webpack-builder) contain a flaw that allows attackers to steal source code during local development. If a developer runs the Nuxt dev server on a network-accessible address and then visits a malicious website, that site can intercept and exfiltrate the developer's source code. This is a regression—an incomplete patch for an earlier vulnerability—affecting versions 3.15.4 through 3.21.6 and 4.0.0 through 4.4.6. The risk is primarily to development environments, not production systems.

• CVE-2026-56301MEDIUM 5.5

  Nuxt, a popular Vue.js framework, has a security issue in its development server that exposes sensitive files on Linux systems. When developers run `nuxt dev`, the framework creates an unprotected communication channel that other users on the same machine can access. An attacker with local access to the server can read private files like environment variables and SSH keys. This only affects development environments; production deployments are safe.

• CVE-2026-45669MEDIUM 5.4

  Nuxt, a popular Vue.js web framework, has a vulnerability in its navigateTo() function when used with the external flag. If an application directs a user to an attacker-controlled URL using this function, the framework generates a server-side redirect page with insufficient sanitization. An attacker can inject malicious HTML and JavaScript into that redirect page, which then executes in the user's browser under the application's origin. This could allow session hijacking, credential theft, or malware distribution. The issue affects Nuxt versions 3.4.3 through 3.21.5 and 4.0.0-alpha.1 through 4.4.5.

• CVE-2026-45670MEDIUM 5.4

  Nuxt, a popular Vue.js framework, contains a security gap in its development server configuration. When developers run the dev server on a non-loopback address (such as making it accessible from other machines on the network), and a developer visits a malicious website while that server is running, an attacker on the same network could potentially steal the developer's source code. This is a regression—an incomplete fix for a previously identified issue. The vulnerability affects versions 3.15.4 through 3.21.5 and 4.0.0-alpha.1 through 4.4.5; patched versions 3.21.6 and 4.4.6 are now available.

• CVE-2026-46342MEDIUM 5.4

  Nuxt, a popular Vue.js framework, contains a vulnerability in its island component rendering system that allows attackers to manipulate server responses by crafting malicious requests. The vulnerability exists because the framework computes a security hash client-side but never validates it server-side, meaning an attacker can request the same endpoint with different parameters and receive unintended responses. This could enable attackers to conduct XSS attacks or retrieve sensitive information if islands expose data meant for other users. The issue affects Nuxt 3.1.0 through 3.21.5 and 4.0.0-alpha.1 through 4.4.5, as well as the associated @nuxt/nitro-server package.

• CVE-2026-53722MEDIUM 5.4

  Nuxt, a popular Vue.js development framework, contains a cross-site scripting vulnerability in its <NuxtLink> component. The component fails to validate URL schemes in values bound to its `to` or `href` props, allowing attackers to inject malicious javascript: or vbscript: URLs. When a user clicks a link crafted this way, arbitrary JavaScript executes within the application's origin. The vulnerability affects versions before 3.21.7 and 4.4.7. Exploitation requires an attacker to control input that binds to the component—such as query parameters, CMS fields, or user profile URLs—and a user to click the malicious link.

• CVE-2026-47200MEDIUM 5.3

  Nuxt, a popular Vue.js web development framework, has a vulnerability where certain server-side page components are exposed over HTTP without proper security checks when a feature called Component Islands is enabled. This exposure allows unauthorized access to sensitive functionality that should only be available to authenticated users or through protected routes. The vulnerability affects Nuxt versions 3.11.0 through 3.21.5 and 4.0.0-alpha.1 through 4.4.5, as well as the related @nuxt/nitro-server package in the same version ranges.