Nuxt.js v4.5.1 Security Update: Fixes RCE, Auth Bypass, and Info Disclosure

Vulnerability Overview This version (v4.5.1) is a security update that addresses multiple severe security issues, including: 1. Server-side Remote Code Execution (RCE): Via server island attributes, routing rule authorization bypass, server component DoS, cross-user payload disclosure in cached pages, and development server path disclosure. 2. Unauthorized Component Instantiation: Via server island attributes. 3. Routing Rule Authorization Bypass: Potentially leading to unauthorized access. 4. Server Component DoS: Potentially causing service unavailability. 5. Cross-User Payload Disclosure: Within cached pages. 6. Development Server Path Disclosure: Potentially leaking sensitive information. Scope of Impact Server-side Remote Code Execution (RCE): Affects all applications using the Nuxt.js framework. Unauthorized Component Instantiation: Affects all applications using server island attributes. Routing Rule Authorization Bypass: Affects all applications using routing rules. Server Component DoS: Affects all applications using server components. Cross-User Payload Disclosure: Affects all applications using cached pages. Development Server Path Disclosure: Affects all applications using the development server. Remediation 1. Upgrade Nuxt.js: It is recommended to upgrade to the latest version as soon as possible using the following command: 2. Clear Cache: If you have already upgraded to include the earlier routing rule fix (CVE-2026-53721), you still need to apply this fix, as this update resolves a regression introduced by that previous fix. 3. Clear CDN or Edge Cache: If you are using , , or routing rules, please clear any CDN or edge caches, as may have been cached upstream. 4. Detailed Fix Information: - Nitro: - Read rspack dev output to lazy-load server entry (#35740) - Parse loaders and runtime dependencies from nuxt dirs (#35668) - Return global route in (#35659) - Ignore custom names or paths in (#35661) - Render client components in nested server components (#35669) - Preserve explicit method inference (#35671) - Revalidate cached route payloads instead of using (#35672) - Correct default export detection in plugin metadata (#35676) - Clear timeouts (#35534) - Add file extension in the parser (#33845) - Preserve trailing slash in (#35501) - Do not cross-contaminate cache (#35666) - Filter plugin dependencies by build target (#35682) - Reload actual page modules in JSX render function pages for HMR (#35678) - Resolve from nuxt's dependency tree (#35690) - Surface module loading errors instead of masking missing ones (#35497) - Type auto-import with nitro's (#35704) - Do not reference app config sources in shared and nitro files (#35673) - Parse SSR inline CSS module class name mismatches (#35610) - Generate layout types even if page modules are disabled (#35717) - Skip stylesheet preloading as a blocking link (#35691) - Deduplicate layers that are both auto-scanned and explicitly extended (#35712) - Do not apply scroll behavior after subsequent navigation (#35719) - Ensure the server sourcemap-preserver plugin actually runs (#35680) - Preserve CSS suffixes when extracting SSR inline styles (#35714) - Monitor external component directories in development (#35652) - Do not exclude client entry modules from style extraction (#35720) - Correct cleanup command in error message (#35735) - Pull only when islands are present on the page (#35739) - Suppress external warnings for internal vite-node paths (#35744) - Use scope-aware cache resolver for auto-imports (#35743) - Synchronize metadata during SSR (#35639) - Add alias for , pinning it to version dependencies (#35774) - Preserve query parameters in cached payload extraction (#35698) - Mirror runtime route tree in generated typed router types (#35788) - Warn when importing preset cannot be resolved (#35799) - Avoid mutating layer configuration when resolving options (#35729) - Precisely convert or discard inline routing rules with a warning (#35455) - Deduplicate and normalize global CSS links (#35834) - Register template HMR plugin on the development server (#35811) - Remove dev error overlay when clearing errors (#35821) - Resolve bundled postcss defaults from the builder (#35823) - Normalize slashes in (#35833) - Bind island attributes and to prevent unauthorized DoS (#355ae9ba) - Preload runtime payload cache (#3541a39) - Fold routing rule keys to match folded lookup (#35547a5a) - Require loopback peer for chrome devtools workspace endpoint (#3569d4f9b) - Reject retaining island attribute in the runtime compiler (#35684633) - Reject top-level attribute for islands (#351651f9) 5. Other Fixes: - Kit: - Preserve trailing slash in (#35501) - Do not cross-contaminate cache (#35666) - Filter plugin dependencies by build target (#35682) - Reload actual page modules in JSX render function pages for HMR (#35678) - Resolve from nuxt's dependency tree (#35690) - Surface module loading errors instead of masking missing ones (#35497) - Type auto-import with nitro'

Goal Reached Thanks to every supporter — we hit 100%!

Nuxt.js v4.5.1 Security Update: Fixes RCE, Auth Bypass, and Info Disclosure

More from this source