Nuxt v3.21.10 Security Update: Fixes SSR RCE and Unauthorized Component Instantiation Vulnerabilities

Vulnerability Overview Version: v3.21.10 Release Date: This week Vulnerability Type: Security Vulnerability Vulnerability Description: - Fixes server-side remote code execution (RCE) and unauthorized component instantiation vulnerabilities, which are exploitable via server-side property injection, route rule authorization bypass, server-side component DoS, and development server path disclosure. - Refreshing the lock file also pulls in , fixing another critical RCE vulnerability that exists only in the development environment. Scope of Impact Affected Versions: All versions prior to v3.21.10 Affected Components: - Server-side components - Route rules - Development server Remediation Upgrade Recommendation: Upgrade to v3.21.10 as soon as possible. Upgrade Command: Important Notes: - If you have already upgraded to v3.21.9, you must still upgrade to v3.21.10, as one of the fixes addresses a regression introduced in v3.21.9. Detailed Fix Contents nuxt: - Clear timeout settings - Preserve trailing slashes in NuxtLink - Fix mismatched SSR inline CSS module class names - Synchronize layout metadata during middleware execution - Update client URLs to match fatal middleware errors in SSR - Monitor external component directories in development - Prevent async key changes in cache - Return the global route from - Ignore custom attributes when reusing existing pages in - Preserve method inference - Fix default export detection in plugin metadata - Re-render JSX rendering function pages for HMR - Ensure the server sourcemap-preserver plugin functions correctly - Resolve issues in the dependency tree - Do not apply scroll behavior after subsequent navigation - Preserve CSS suffixes when extracting SSR inline styles - Do not exclude client entry modules from style extraction - Avoid modifying layer configurations during option resolution - Generate layout types when page modules are disabled - Skip resource hints for stylesheets already rendered as blocking links - Re-validate cached route payloads - Preserve query parameters in cache payload extraction - Resolve loaders and runtime dependencies in the directory - Render client components within nested server components - Remove dev error overlay when clearing errors - Fix post-build CSS defaults in the builder - Normalize slashes in - Match route keys in folded lookups - Require logging peers for Chrome DevTools workspace endpoints - Bind server-side properties and to prevent unauthenticated DoS - Reject reserved template island properties in the runtime compiler - Reject top-level as an island vite: - Fix mismatched SSR inline CSS module class names - Ensure the server sourcemap-preserver plugin functions correctly - Preserve CSS suffixes when extracting SSR inline styles - Do not exclude client entry modules from style extraction kit: - Avoid modifying layer configurations during option resolution - Generate layout types when page modules are disabled - Skip resource hints for stylesheets already rendered as blocking links - Re-validate cached route payloads - Preserve query parameters in cache payload extraction - Resolve loaders and runtime dependencies in the directory - Render client components within nested server components - Remove dev error overlay when clearing errors - Fix post-build CSS defaults in the builder - Normalize slashes in - Match route keys in folded lookups - Require logging peers for Chrome DevTools workspace endpoints - Bind server-side properties and to prevent unauthenticated DoS - Reject reserved template island properties in the runtime compiler - Reject top-level as an island nitro: - Skip resource hints for stylesheets already rendered as blocking links - Re-validate cached route payloads - Preserve query parameters in cache payload extraction - Resolve loaders and runtime dependencies in the directory - Render client components within nested server components - Remove dev error overlay when clearing errors - Fix post-build CSS defaults in the builder - Normalize slashes in - Match route keys in folded lookups - Require logging peers for Chrome DevTools workspace endpoints - Bind server-side properties and to prevent unauthenticated DoS - Reject reserved template island properties in the runtime compiler - Reject top-level as an island rspack,webpack: - Resolve loaders and runtime dependencies in the directory - Render client components within nested server components - Remove dev error overlay when clearing errors - Fix post-build CSS defaults in the builder schema: - Normalize slashes in Additional Information Contributors: Multiple contributors participated in this security fix Documentation: Relevant documentation and security best practices are provided Testing: Extensive testing was conducted to ensure the effectiveness of the fixes Summary v3.21.10 is a critical security update that fixes multiple severe vulnerabilities. All users are advised to upgrade immediately to ensure application security.

Goal Reached Thanks to every supporter — we hit 100%!

Nuxt v3.21.10 Security Update: Fixes SSR RCE and Unauthorized Component Instantiation Vulnerabilities

More from this source