Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

nuxt — Vulnerabilities & Security Advisories 34

All 34 CVE vulnerabilities found in nuxt, with AI-generated Chinese analysis, references, and POCs.

This page aggregates Common Weakness Enumerations (CWE) associated with the Nuxt.js web application framework developed by Vercel. It collects reported security vulnerabilities affecting various versions of the Nuxt framework, its core dependencies, and associated ecosystem packages. The data spans from the initial public release of the framework up to the most recent disclosures in the current year, providing a longitudinal view of security incidents. Here, you can track vendor advisories released by the Nuxt team, understand the prevalence and impact of specific weakness classes such as cross-site scripting or improper input validation, and look up the product's vulnerability history to assess risk exposure over time. The aggregation includes both direct flaws within the Nuxt codebase and indirect vulnerabilities arising from third-party libraries utilized by default in standard project configurations. This resource is designed for security researchers, developers, and system administrators who need to audit their Nuxt-based applications against known issues. By centralizing this information, the page facilitates better decision-making regarding patching strategies, dependency management, and security posture evaluation. Users can filter results by severity, version, or weakness type to identify relevant threats specific to their deployment environment. The information is sourced from official vendor advisories, public vulnerability databases, and automated scanning reports, ensuring a comprehensive overview of the threat landscape for this popular JavaScript framework.

Vendor: nuxt

CVE ID Title CVSS Severity Published
CVE-2026-119201 Nuxt dev server exposes generated appSecret through Vite file serving CWE-552 4.8 Medium 2026-10-29
CVE-2026-119200 Nuxt: Dot segments in the request path bypass `server/middleware` path checks and server route rules on page routes CWE-41 6.5 Medium 2026-10-29
CVE-2026-119199 Nuxt dev server exposes private runtime config through the Nitro dev bundle CWE-200 5.9 Medium 2026-10-29
CVE-2026-119198 Nuxt dev server arbitrary file read through client error reports CWE-73 5.9 Medium 2026-10-29
CVE-2026-114133 Nuxt server islands render `useHeadSafe` input without sanitisation CWE-79 5.4 Medium 2026-10-21
CVE-2026-114132 Nuxt: Server-side route rules (`redirect`, `headers`, `proxy`, `ssr`) are skipped for case-variant paths when routing is case-insensitive CWE-178 6.3 Medium 2026-10-21
CVE-2026-114131 Nuxt: Route rules are matched against the raw request path, so a percent-encoded segment can bypass `appMiddleware` on dynamic and catch-all routes CWE-436 6.5 Medium 2026-10-21
CVE-2026-114130 Nuxt: Incomplete fix for GHSA-934w-87qh-qr26: a `javascript:` URL prefixed with an ASCII control character executes from `<NuxtLink>` when `pages` is disabled CWE-79 2.3 Low 2026-10-21
CVE-2026-72744 Nuxt before 4.5.1 Information Disclosure via Chrome DevTools CWE-200 6.2 Medium 2026-08-11
CVE-2026-71321 Nuxt: Unauthenticated CPU exhaustion parsing and hashing the Nuxt island endpoint body before hash validation CWE-407 7.5 High 2026-08-05
CVE-2026-71320 Nuxt: Server-Side Remote Code Execution via Runtime Template Injection in Nuxt Server Island Props CWE-74 8.1 High 2026-08-05
CVE-2026-71318 Nuxt: Unauthorized Component Instantiation via Server Island Props CWE-20 4.8 Medium 2026-08-05
CVE-2026-71316 Nuxt runtime payload cache discloses another user's SSR data across users and to unauthenticated clients CWE-524 7.5 High 2026-08-05
CVE-2026-71315 Nuxt route rules silently dropped for mixed-case paths, bypassing appMiddleware auth gates (incomplete fix for CVE-2026-53721) CWE-178 8.2 High 2026-08-05
CVE-2026-71314 Nuxt: Unauthenticated out-of-memory crash via unbounded v-for expansion in island rendering CWE-400 7.5 High 2026-08-05
CVE-2026-56301 Nuxt - Arbitrary File Read via World-Connectable vite-node IPC Socket on Linux CWE-276 5.5 Medium 2026-06-23
CVE-2026-56698 Nuxt - Cross-Site Scripting via navigateTo open Option CWE-79 6.1 Medium 2026-06-22
CVE-2026-56697 Nuxt - Open Redirect via Protocol-Relative Paths in reloadNuxtApp CWE-601 6.1 Medium 2026-06-22
CVE-2026-56326 Nuxt - Server-Side Open Redirect via Path-Normalization Bypass in navigateTo CWE-601 6.1 Medium 2026-06-22
CVE-2026-56317 Nuxt - Cross-Site Scripting via NoScript Component Slot Content CWE-79 - - 2026-06-20
CVE-2026-53722 Nuxt: Reflected XSS in `<NuxtLink>` via unsanitised `javascript:` or `data:` URL CWE-79 - - 2026-06-12
CVE-2026-53721 Nuxt: Route-rule middleware bypass via case-sensitivity mismatch between vue-router and the routeRules matcher CWE-178 - - 2026-06-12
CVE-2026-47200 Nuxt: Route middleware not enforced when rendering `.server.vue` pages via `/__nuxt_island/page_*` CWE-284 - - 2026-06-12
CVE-2026-49993 @nuxt/webpack-builder and @nuxt/rspack-builder dev server same-origin check bypassed when Sec-Fetch-Site, Origin, and Referer are all absent (incomplete fix for GHSA-6m52-m754-pw2g) CWE-749 - - 2026-06-12
CVE-2026-45669 Nuxt: Reflected XSS in `navigateTo()` external redirect CWE-83 - - 2026-06-12
CVE-2026-45670 Nuxt: Dev server exposes built source over LAN to malicious sites (incomplete fix for GHSA-4gf7-ff8x-hq99) CWE-749 - - 2026-06-12
CVE-2026-46342 Nuxt: `__nuxt_island` endpoint does not bind responses to request props, enabling shared-cache poisoning CWE-79 - - 2026-06-12
CVE-2025-59414 Nuxt Client-Side Path Traversal in Nuxt Island Payload Revival CWE-22 3.1 Low 2025-09-17
CVE-2025-27415 Nuxt allows DOS via cache poisoning with payload rendering response CWE-349 7.5 High 2025-03-19
CVE-2025-24361 Opening a malicious website while running a Nuxt dev server could allow read-only access to code CWE-749 5.3 Medium 2025-01-25

All 34 known CVE vulnerabilities affecting nuxt with full Chinese analysis, references, and POCs where available.