Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-114130— Nuxt: Incomplete fix for GHSA-934w-87qh-qr26: a `javascript:` URL prefixed with an ASCII control character executes from `<NuxtLink>` when `pages` is disabled

Quick assessment

Affected
nuxt nuxt
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Nuxt 是一个面向 Vue.js 的开源 Web 开发框架。在 4.6.0 版本之前，针对 CVE-2026-53722 的修复尚不完整：若应用程序禁用了页面功能，且攻击者控制的输入（绑定到 属性）以 ASCII C0 控制字符开头，则 NuxtLink 会渲染出可执行脚本的 URL。由于无页面（no-pages）路由在早期的协议检查之前，就将该值判定为内部路由并传递给渲染后的锚点 属性，浏览器在解析时会移除前导控制字符，从而将剩余的 URL 解释为可执行脚本。此问题影响默认锚点及 NuxtLink 的自定义输出

CVSS 2.3 · Low

Affected Version Matrix 1

VendorProduct Version RangeStatus
nuxt nuxt < 4.6.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-114130

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Nuxt: Incomplete fix for GHSA-934w-87qh-qr26: a `javascript:` URL prefixed with an ASCII control character executes from `<NuxtLink>` when `pages` is disabled
Source: CVE Program / CVE List V5
Vulnerability Description
Nuxt is an open-source web development framework for Vue.js. Prior to 4.6.0, an incomplete fix for CVE-2026-53722 allows an application with pages disabled to render a script-capable URL through NuxtLink when attacker-controlled input bound to to is prefixed with an ASCII C0 control character. The no-pages router classifies the value as an internal route before the earlier protocol check and passes it to the rendered anchor href; browsers remove the leading control character and interpret the remaining javascript: URL. The default anchor and NuxtLink custom output are affected, the unsafe href is present in server-rendered HTML, and a victim must click the link for script to execute in the application's origin. This issue is fixed in version 4.6.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
nuxt nuxt < 4.6.0 -

II. Public POCs for CVE-2026-114130

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-114130

请登录查看更多情报信息。

Other References for CVE-2026-114130 (5)

Same Patch Batch · nuxt · 2026-10-21 · 4 CVEs total

CVE-2026-114131 6.5 MEDIUM Nuxt: Route rules are matched against the raw request path, so a percent-encoded segment c
CVE-2026-114132 6.3 MEDIUM Nuxt: Server-side route rules (`redirect`, `headers`, `proxy`, `ssr`) are skipped for case
CVE-2026-114133 5.4 MEDIUM Nuxt server islands render `useHeadSafe` input without sanitisation

IV. Related Vulnerabilities

Same product: nuxt
Same vendor: nuxt
Same weakness: CWE-79

V. Comments for CVE-2026-114130

No comments yet

Leave a comment