@nuxt/nitro-server

4.6.2 · 16 Oct 2026MIT1.1M / weekRepository Homepage npm Atom feed

Security advisories

From OSV, open ones first. Each release line gets its own fix: an older major is fixed by a patch on that major, not by moving to the newest one.

Paste your package.json, or type the range you declare for @nuxt/nitro-server. It is read in your browser and sent nowhere.

Line	Newest	Where it stands
	4.6.2	Safe from 4.4.6
	3.21.11	Safe from 3.21.6

Your version

Moderate
Nuxt's route middleware is not enforced when rendering `.server.vue` pages via `/__nuxt_island/page_*`GHSA-hg3f-28rg-4jxj · 29 May 2026
- 4.x4.2.0 – 4.4.5Fixed in 4.4.6
- 3.x3.20.0 – 3.21.5Fixed in 3.21.6
Low
Nuxt: `__nuxt_island` endpoint does not bind responses to request props, enabling shared-cache poisoningGHSA-g8wj-3cr3-6w7v · 19 May 2026
- 4.x4.2.0 – 4.4.5Fixed in 4.4.6
- 3.x3.20.0 – 3.21.5Fixed in 3.21.6

What npm and deps.dev say about the latest release. Signals, not a verdict.

Reading npm and deps.dev…

Registry facts last checked 21 Oct 2026. Releases and advisories last read 21 Oct 2026.