Packages / nuxt / Security

ModerateVulnerabilityGHSA-c9cv-mq2m-ppp3Published 16 Jun 2026

Nuxt: URL-handling weaknesses in `navigateTo` and `reloadNuxtApp`: SSR open redirect, client-side script execution via the `open` option, and protocol-relative bypass in `reloadNuxtApp`

Affected · nuxt

  • >= 4.0.0, < 4.4.7
  • >= 3.5.0, < 3.21.7

Fixed in

4.4.7

npm install nuxt@4.4.7

  1. Not affected

    0.0.1 – 3.4.3

    179 releases

  2. Affected

    3.5.0 – 3.21.6

    71 releases

  3. Fixed

    3.21.7 – 3.21.11

    5 releases

  4. Affected

    4.0.0 – 4.4.6

    17 releases

  5. Fixed

    4.4.7 – 4.6.2

    8 releases, latest

280 stable releases of nuxt, oldest to newest.

What happens

The full text is not stored yet. Read it on osv.dev.