Packages / nuxt / Security

HighVulnerabilityGHSA-9473-5f9j-94wqPublished 5 Aug 2026

Nuxt: Server-Side Remote Code Execution via Runtime Template Injection in Nuxt Server Island Props

Affected · nuxt

  • >= 4.0.0, < 4.5.1
  • >= 3.4.0, < 3.21.10

Fixed in

4.5.1

npm install nuxt@4.5.1

  1. Not affected

    0.0.1 – 3.3.3

    175 releases

  2. Affected

    3.4.0 – 3.21.9

    78 releases

  3. Fixed

    3.21.10 – 3.21.11

    2 releases

  4. Affected

    4.0.0 – 4.5.0

    20 releases

  5. Fixed

    4.5.1 – 4.6.2

    5 releases, latest

280 stable releases of nuxt, oldest to newest.

What happens

The full text is not stored yet. Read it on osv.dev.