CVE-2026-56697: Nuxt Protocol-Relative URL Open Redirect in reloadNuxtApp

Technical summary

The vulnerability is a URL validation bypass in the `reloadNuxtApp` function affecting Nuxt v4 and v3. The function implements a allowlist check to prevent script-protocol injection, but does not account for protocol-relative URLs. A path like `//evil.com` passes the script-protocol check because it does not match patterns like `javascript:` or `data:`, yet the browser interprets `//` as inheriting the current page's protocol, resulting in a cross-origin redirect. This falls under CWE-601 (Open Redirect). The attack requires user interaction (clicking a link or visiting a compromised page) but no authentication or special privileges.

Business impact

Organizations deploying Nuxt applications face phishing and credential theft risks. Attackers can craft links or inject malicious redirect payloads that appear legitimate because they originate from the trusted Nuxt application, increasing click-through rates on phishing campaigns. OAuth flows are particularly vulnerable: an attacker can intercept the authorization code before the user is redirected to the attacker's fake login page, then replay that code or use it to compromise the user's account. The impact is elevated because Nuxt is widely used in production SaaS and consumer applications where trust in the initial domain is high.

Affected systems

Nuxt 4.0.0 through 4.4.6 and Nuxt 3.x through 3.21.6 are vulnerable. Any application using the `reloadNuxtApp` function with user-controlled or partially controlled URL parameters is at risk. Applications relying on Nuxt's URL handling for authentication flows (SSO, OAuth) or sensitive redirects are especially exposed. Versions 4.4.7 and 3.21.7 or later contain the fix.

Exploitability

This vulnerability is straightforward to exploit and requires no special tooling or advanced knowledge. An attacker crafts a URL containing a protocol-relative path (e.g., `?redirect=//attacker.com`) and shares it via phishing email, social engineering, or injection into a compromised third-party resource. The attack succeeds if a user clicks the link or if the application automatically processes the parameter. The CVSS score of 6.1 (MEDIUM) reflects the requirement for user interaction and the absence of immediate system-level compromise, but the low barrier to exploitation and real-world harm (credential theft) mean practical risk may exceed the base score depending on deployment context.

Remediation

Upgrade Nuxt to version 4.4.7 or later for v4 deployments, or to version 3.21.7 or later for v3 deployments. The patches correct the URL validation logic in `reloadNuxtApp` to reject protocol-relative paths. Organizations should also audit their application code for any custom redirect logic that may have similar gaps, and implement additional server-side validation of redirect targets whenever possible.

Patch guidance

1. Update your Nuxt dependency immediately: for v4, upgrade to 4.4.7+; for v3, upgrade to 3.21.7+. Verify the specific patch version against your package manager and the Nuxt release notes. 2. If you are unable to patch immediately, restrict or remove user-controlled input to the `reloadNuxtApp` function, or implement a strict allowlist of permitted redirect destinations on the server side. 3. Consider adding a Content Security Policy (CSP) directive to restrict where the page can redirect, as a defense-in-depth measure. 4. Test your application after patching to ensure no regression in legitimate redirect flows.

Detection guidance

Monitor application logs and analytics for unusual redirect patterns: look for requests to `reloadNuxtApp` with protocol-relative or unexpected external domains in the URL parameter. Implement logging of all redirect events in your Nuxt application, including the source and destination. Network-level detection is limited because the redirect occurs in the browser, but you can use Web Application Firewall (WAF) rules to flag requests containing suspicious URL patterns like `//` in common parameter names (e.g., `redirect`, `return`, `next`, `url`). Client-side monitoring via Content Security Policy violation reports can also alert you to unexpected cross-origin redirects.

Why prioritize this

While the CVSS score is MEDIUM, this vulnerability warrants prompt patching because it directly enables credential and authorization-code theft in a trusted context. Nuxt is widely deployed, the fix is straightforward to apply, and the exploitation method is trivial. Organizations running Nuxt with user-facing authentication or OAuth flows should treat this as high priority. However, organizations where Nuxt is used for internal or non-authentication-critical applications may operate at lower risk.

Risk score, explained

The CVSS 3.1 score of 6.1 reflects a network-based attack (`AV:N`), low attack complexity (`AC:L`), no privilege requirement (`PR:N`), required user interaction (`UI:R`), changed scope (`S:C`), and limited confidentiality and integrity impact (`C:L/I:L`) with no availability impact (`A:N`). The user-interaction requirement prevents a higher score. In practice, the severity may feel higher because the attack enables phishing and OAuth theft, which have severe downstream consequences. The `S:C` (scope changed) vector appropriately captures the cross-origin nature of the attack.

Frequently asked questions