By vendor

Nuxt vulnerabilities

Known CVEs affecting Nuxt products, prioritized by severity, with SEC.co remediation and detection guidance.

4 published vulnerabilities

• CVE-2026-49993MEDIUM 5.7

  Nuxt's build tools (rspack-builder and webpack-builder) contain a flaw that allows attackers to steal source code during local development. If a developer runs the Nuxt dev server on a network-accessible address and then visits a malicious website, that site can intercept and exfiltrate the developer's source code. This is a regression—an incomplete patch for an earlier vulnerability—affecting versions 3.15.4 through 3.21.6 and 4.0.0 through 4.4.6. The risk is primarily to development environments, not production systems.

• CVE-2026-45669MEDIUM 5.4

  Nuxt, a popular Vue.js web framework, has a vulnerability in its navigateTo() function when used with the external flag. If an application directs a user to an attacker-controlled URL using this function, the framework generates a server-side redirect page with insufficient sanitization. An attacker can inject malicious HTML and JavaScript into that redirect page, which then executes in the user's browser under the application's origin. This could allow session hijacking, credential theft, or malware distribution. The issue affects Nuxt versions 3.4.3 through 3.21.5 and 4.0.0-alpha.1 through 4.4.5.

• CVE-2026-45670MEDIUM 5.4

  Nuxt, a popular Vue.js framework, contains a security gap in its development server configuration. When developers run the dev server on a non-loopback address (such as making it accessible from other machines on the network), and a developer visits a malicious website while that server is running, an attacker on the same network could potentially steal the developer's source code. This is a regression—an incomplete fix for a previously identified issue. The vulnerability affects versions 3.15.4 through 3.21.5 and 4.0.0-alpha.1 through 4.4.5; patched versions 3.21.6 and 4.4.6 are now available.

• CVE-2026-47200MEDIUM 5.3

  Nuxt, a popular Vue.js web development framework, has a vulnerability where certain server-side page components are exposed over HTTP without proper security checks when a feature called Component Islands is enabled. This exposure allows unauthorized access to sensitive functionality that should only be available to authenticated users or through protected routes. The vulnerability affects Nuxt versions 3.11.0 through 3.21.5 and 4.0.0-alpha.1 through 4.4.5, as well as the related @nuxt/nitro-server package in the same version ranges.