CVE-2026-56326: Nuxt Open Redirect Vulnerability in navigateTo (CVSS 6.1)

Technical summary

The `navigateTo` function in affected Nuxt versions implements insufficient path validation when determining whether a redirect target is external. Specifically, the validation logic fails to properly canonicalize or normalize path-based payloads before comparison, allowing attackers to bypass external-host checks using techniques such as prepending path traversal sequences (e.g., `/..//evil.com`) or redundant path separators (e.g., `/.//evil.com`). When an attacker-controlled payload passes validation, the framework issues a redirect via the HTTP Location header or meta-refresh tag, directing the victim's browser to the attacker's site. This maps to CWE-601 (URL Redirection to Untrusted Site / 'Open Redirect').

Business impact

Open redirect vulnerabilities in web frameworks enable credential harvesting, phishing campaigns, and OAuth token interception. A threat actor could create a legitimate-looking link to a Nuxt-based application and embed a malicious redirect parameter, then distribute it via email or social engineering. When users click the link, they are silently redirected to a fake login page or attacker infrastructure. This is particularly damaging for applications that handle sensitive user data, financial transactions, or federated authentication. Even though user interaction is required, the redirect feels organic (users expect to be redirected) and phishing success rates against this vector are historically high.

Affected systems

Nuxt 4.0.0 through 4.4.6 and Nuxt 3.x versions before 3.21.7 are affected. Any web application built with these versions that uses the `navigateTo` function for client-side or server-side routing is vulnerable if it accepts user-controlled redirect parameters. This includes e-commerce sites, SaaS platforms, and any application using Nuxt's built-in navigation features without additional input hardening.

Exploitability

Exploitability is straightforward. An attacker needs only to craft a malicious URL containing a path-normalized payload (e.g., `https://victim-app.com/?redirect=/..//attacker.com`) and trick a user into clicking it. No authentication, special network access, or interaction with the application logic is required beyond the initial click. The attack surface is broad: any application accepting redirect parameters in query strings, form fields, or internal navigation calls is at risk. However, the user interaction requirement (CUI: Required) provides a modest friction barrier; automated attacks cannot succeed without social engineering.

Remediation

Update to Nuxt 4.4.7 or later for version 4.x installations, or Nuxt 3.21.7 or later for version 3.x. After upgrading, no application code changes are strictly required, as the fix is in the framework itself. However, we recommend conducting a code review to identify any instances where user-supplied input is passed directly to `navigateTo` without validation, and consider adding a whitelist of allowed redirect destinations as defense-in-depth.

Patch guidance

Verify against the official Nuxt release notes for exact version numbers. The patched versions are 4.4.7+ and 3.21.7+. For projects using npm or yarn, update via `npm update nuxt` or `yarn upgrade nuxt`. Test the update in a staging environment, as framework updates can occasionally affect routing or navigation behavior. If you maintain multiple projects, prioritize those handling authentication, payment processing, or sensitive data.

Detection guidance

Monitor HTTP response headers and meta tags for unexpected Location headers or meta-refresh redirects that point to external domains. Web application firewalls (WAF) and proxy logs may show malicious `navigateTo` parameter patterns (e.g., suspicious URL encoding or path traversal sequences in redirect parameters). Search application logs for invocations of `navigateTo` with external destinations. If your application logs redirect decisions, look for attempts to bypass validation using patterns like `/..//`, `/.//`, or similar Unicode/encoding tricks. Correlate suspicious redirects with phishing or credential-theft incidents.

Why prioritize this

This vulnerability merits urgent but not emergency attention. The CVSS score of 6.1 (Medium) reflects moderate impact and the user-interaction requirement. However, the attack is trivial to execute and effective at scale via email campaigns. Organizations with exposed Nuxt applications should prioritize patching within the next 1–2 weeks, especially if they handle authentication or financial data. The fix is simple (a version bump) and poses low regression risk.

Risk score, explained

CVSS 6.1 (Medium) is assigned due to network accessibility (AV:N), low attack complexity (AC:L), no privileges required (PR:N), and required user interaction (UI:R). The scope is changed (S:C) because the redirect affects the user's trust in the application and can expose authentication tokens to a third party. Confidentiality and integrity impacts are rated Low (C:L/I:L) rather than High because the vulnerability enables credential or information theft rather than direct data exfiltration from the application itself. Availability is unaffected (A:N).

Frequently asked questions