CVE-2026-45669: Nuxt navigateTo() XSS Vulnerability (3.21.6, 4.4.6 Patches)

Technical summary

The vulnerability exists in how navigateTo() constructs a meta http-equiv="refresh" redirect when external: true is specified. The function attempts to sanitize the destination URL by replacing quotation marks with %22, but fails to encode angle brackets (<, >), ampersands (&), and apostrophes ('). An attacker controlling the URL parameter can break out of the content attribute and inject arbitrary HTML/JavaScript. Because the redirect originates from the server, the injected payload executes within the application's security context rather than a sandboxed external origin. This is categorized as an Improper Neutralization of Input During Web Page Generation (CWE-83).

Business impact

Any Nuxt application that uses navigateTo() with external: true to handle user-supplied or dynamically-constructed URLs faces cross-site scripting risk. An attacker could impersonate users, steal authentication tokens, manipulate session data, or deliver malware without triggering browser security warnings. The attack requires user interaction (clicking a link), but the payload executes server-side under the legitimate application domain, bypassing many browser protections. Organizations relying on Nuxt for authentication flows or sensitive redirects are at particular risk.

Affected systems

Vulnerable versions include Nuxt 3.4.3 through 3.21.5 (inclusive) and Nuxt 4.0.0-alpha.1 through 4.4.5 (inclusive). Any application using these versions with navigateTo() for external redirects is affected. The vulnerability does not require special configuration; it is introduced by the function's default sanitization behavior. Applications using navigateTo() for internal-only redirects or without user-controlled URL parameters are lower-risk but should still be patched.

Exploitability

Exploitation requires an attacker to influence the URL parameter passed to navigateTo(). This could occur through query parameters, fragment identifiers, API responses, or form inputs that are passed directly to the function without additional validation. The attack requires user interaction—specifically, the user must be directed to a page that triggers the vulnerable call. No authentication or special privileges are needed on the attacker's side. The CVSS score of 5.4 (Medium) reflects that impact is limited to confidentiality and integrity of user-specific data, not system availability.

Remediation

Upgrade Nuxt to version 3.21.6 or later for the 3.x branch, or version 4.4.6 or later for the 4.x branch. These versions implement proper HTML entity encoding for all special characters in the redirect URL, preventing attribute escape and script injection. Patch testing should validate that legitimate external redirects still function correctly and that no encoding side-effects affect URL handling.

Patch guidance

1. Review your package.json and identify your current Nuxt version. 2. If running 3.4.3–3.21.5, upgrade to 3.21.6 or newer. If running 4.0.0-alpha.1–4.4.5, upgrade to 4.4.6 or newer. 3. Run your dependency audit tools (npm audit, yarn audit) to confirm the patch is applied. 4. Test all external redirect flows in your application, including edge cases with special characters in URLs. 5. Consider using a Content Security Policy (CSP) header with frame-ancestors and script-src directives as an additional layer of defense against injected content.

Detection guidance

Search your codebase for instances of navigateTo() with the external flag set to true. Audit what URLs are being passed to these calls—if they derive from user input, query parameters, or API responses, prioritize those for patching. Monitor server logs for unusual meta refresh tag content or HTML-like patterns in redirect URLs (e.g., '><script'). Implement a WAF rule to detect angle brackets or suspicious entities in redirect parameters if possible. Security-focused static analysis tools may flag this pattern if configured to detect improper sanitization in redirect logic.

Why prioritize this

Although the CVSS score is Medium, this vulnerability should be prioritized for patching because it enables direct XSS in a core framework function used widely in Nuxt applications. The attack surface is broad—any application using navigateTo() with external: true and user-influenced URLs is at risk. Unlike many XSS vulnerabilities limited to reflected scenarios, this one is embedded in framework behavior and affects multiple applications simultaneously. Patching is straightforward and carries low regression risk, making this a high-value, low-effort remediation.

Risk score, explained

The CVSS 5.4 score reflects: Attack Vector Network (AV:N) — exploitable remotely; Attack Complexity Low (AC:L) — no special conditions required; Privileges Required None (PR:N) — no authentication needed; User Interaction Required (UI:R) — user must follow a link; Scope Unchanged (S:U) — impact limited to the vulnerable component; Confidentiality Impact Low (C:L) — user session data may be read; Integrity Impact Low (I:L) — user-controlled data may be modified; Availability Impact None (A:N) — no denial of service. The score does not account for widespread adoption of Nuxt or the framework-level nature of the flaw, which elevates practical risk beyond the numeric score.

Frequently asked questions