@nuxt/vite-builder
4.6.2 · 16 Oct 2026MIT1.3M / weekRepositoryHomepagenpmAtom feed
130 stable releases, newest first, by release line. Notes are quoted as the maintainers published them.
- 4.x · latest line
4.6.2
16 Oct 2026nitro: apply
useHeadSaferules to server island headnitro-server: read router params from the path h3 matched
nitro: match server route rules case-insensitively unless routing is sensitive
v4.6.2 is the next patch release.
Changelog
Fixes
nitro: apply
useHeadSaferules to server island headnitro-server: read router params from the path h3 matched
nitro: match server route rules case-insensitively unless routing is sensitive
nuxt: resolve rooted paths through the URL parser
nuxt: resolve empty route types in shared context
nitro: preserve server tsconfig with relocated build dir
nuxt: fix scroll offset for IDs starting with numbers
kit: do not exclude module directories with a dot in their name from app tsconfig
nuxt: detect vapor slots with
rawVaporSlotKeyfrom vuenuxt: keep middleware layout when restoring deferred prerendered route
schema: provide default value for
experimental.typescriptPluginvite: only replay compile error overlays to newly loaded pages
nuxt: re-export
AnyFetchPathfor emitted server route typesvite: warm up the dev ssr entry from a nitro plugin
nitro: avoid unused h3 imports in nuxt/server runtime
vite-server: scope asset url helpers to the build
nuxt: resolve
nuxt/appto the app's runtimekit: lowercase filename-derived handler method on nitro v2
nuxt,nitro: normalise string/array
appMiddlewarenitro: pass response headers to
render:responselistenersvite: resolve inlined
vueto its bundler build in devnuxt: don't start a page transition with no page to leave
nuxt: preserve error state on aborted or cancelled navigation
vite,nitro: link null-byte virtual css through
/@id/in devkit: resolve module dependencies from the declaring module
nitro: only disable h3 + nitro presets when
nitroAutoImportsis offnitro,vite: don't access unspecified dependencies
nitro: don't inline deps under absolute transpile dirs
vite-server: respect spa loading template location
4.6.1
9 Oct 2026nitro: build the portable event's web view on first access
vite: match vite 8.1+ optimizer messages for deps hint
nuxt: accept any
baseURLwhen fetch response type is named
v4.6.1 is the next patch release.
Changelog
Performance
nitro: build the portable event's web view on first access
Fixes
vite: match vite 8.1+ optimizer messages for deps hint
nuxt: accept any
baseURLwhen fetch response type is namednitro: resolve
nitropack/typesdeclarations under nodenextnuxt: allow
falseinsetPageLayouttypesnuxt: align
Serializeobject types with JSONvite: don't abort dep scan on virtual imports in installed packages
nuxt: update
publishConfigconfig export extensionkit: install the package a missing subpath belongs to
vite-server: use the configured outDir as the public directory for non-ssr environment
kit,nitro: match dev handler paths on both nitro majors
nuxt: preserve onServerPrefetch for useId hydration
vite-server: include the request in dev error reports
nitro: register each dev server handler once
nitro: pass
RequestEventtonuxtdev server handlersnuxt: type the global
$fetchwith nuxt'sTypedFetchvite-server: work with deploy target plugins in dev
schema: ignore
.wranglerdirectoryvite-server: pass the path to the error page render
nuxt,vite: disable dev error broadcast if
BroadcastChannelthrowskit: align semantic version regexp with nightly version format
nuxt: export types reachable from async data composables
vite: detect enclosing string delimiter in inline style urls
schema: type the
nuxtdev server handler variantnitro: inline nuxt runtime when resolved to windows paths
nitro: resolve
unheadfrom nuxt in server bundle
4.6.0
5 Oct 2026v4.6.0 is the next minor release.
Some news
Nuxt CLI v4
Alongside the release of Nuxt v4.6, today also brings a new major release of the Nuxt CLI:
@nuxt/cliv4. It ships as a dependency ofnuxt, so you'll get it automatically when you upgrade.Most of what's new is in
nuxt dev:an interactive terminal UI, showing URLs, startup progress and keyboard shortcuts, with panels to dive into error logs, routes, network requests and more
the dev server gives you more info, such as why it reloaded or restarted, which
nuxt.configkeys changed, where the time went during a slow start or build, and how long each module took to set upa CLI-level error channel rendered with
my-bad(see below), powering things like automatically reloading when a syntax error innuxt.config.tsis fixeda lock file in
.nuxt/, which lets a secondnuxt dev(say, one started by an agent) take over or defer to the one you started, and powers newnuxt curlandnuxt taskcommands that talk to the running server
There's also a new
nuxt docs "<query>"search, andnuxt preview --takeovercan replace a running preview server. And in generalnuxt/cliis a lot smaller and starts a lot faster:v3.37 v4.0 @nuxt/cliinstall size13.1 MB 3.5 MB -73% @nuxt/clidependencies70 31 -56% nuxt dev: first paint330 ms 50 ms 6.6x faster nuxt dev: port bound338 ms 104 ms 3.2x faster nuxt dev: memory at rest (Linux)630 MB 440 MB -30% Although this is a major version, none of the changes should be breaking for Nuxt v4 users: we require Node.js v22.21+, v24.11+ or v26+, we drop
nuxt initand only supportnpm create nuxt@latest, and Nuxt 2 and@nuxt/bridgeare no longer supported.👉 Check out the full Nuxt CLI v4 release notes for everything that's changed.
A server-agnostic Nuxt
The biggest thing about this release is our move towards making Nuxt server-agnostic.
I feel that freedom of choice is very much a fundamental value of the web, and one that unites the whole Nuxt team.
You can use
pages/(with vue-router) or not. You can use Vite, webpack or Rspack to bundle your code. You can pick from dozens of providers to deploy to, pick any image or font provider, choose any database adapter. In every case, the framework is the same.The server side was different.
#appcomposables imported h3 types, server code imported fromh3andnitropack, and every module that touched the server was tied to whichever major version of those packages Nuxt happened to depend on.This has become particularly clear as we have been upgrading to new majors of h3 and nitro, which ship breaking changes with a cascading effect throughout the whole ecosystem.
👉 This release changes that.
Alongside explicitly defining our public API in
nuxt/kit(which now does not refer to external packages), Nuxt now specifies our own types for the request event, route rules and typed$fetch, and we expose an import surface (nuxt/server) for the server utilities that will be needed by most apps.This is the culmination of work we started almost a year ago, making it possible to use any server builder with Nuxt, not just Nitro (#33462).
Of course, under the hood,
nuxt/serveris still powered by Nitro by default - though we are also announcing a second, experimental implementation,@nuxt/vite-server, which allows pure-Vite server builds using the Vite Environment API.[!IMPORTANT]
We believe that Nitro is still the right choice for almost everyone.🌟 We see a number of key benefits for
nuxt/server.it smooths the upgrade to Nuxt 5, which moves to Nitro v3 and h3 v2. Server code written against
nuxt/serveron 4.6 runs unchanged there, so a module can ship one file for both.it decouples Nuxt from the Nitro release cycle. Because we 'own' the API, we can adapt to breaking changes in Nitro or h3 without requiring a future major - and we can release Nuxt majors without having to wait for upstream releases.
it makes Nuxt's code more maintainable. It helps us preserve the separation of concerns between our API -
/appand/server- and the bundler + server that you ultimately want to build your app.
... and there are a number of other benefits too, from a single type surface to being able to iterate more quickly on features.
Finally, I want to say a special thank-you to @pi0, whose relentless focus on server agnosticism and work on h3, Nitro and web-standard server primitives over the last few years is what makes a portable
RequestEventpossible at all. Thank you, Pooya. ❤️Almost every feature in this release is already in the Nuxt 5 branch, and most of the remaining Nuxt 5 defaults can be tested today with
future.compatibilityVersion: 5(more details below!).[!TIP]
Nuxt 3 reached end-of-life on July 31, 2026, so there is no 3.x release alongside this one. If you're still on v3, the upgrade guide is waiting for you.Highlights
🤷 If you've read this far I'm afraid I have bad news for you: there's a lot more still to say! Nuxt 4.6 is one of our biggest minor releases, with over 420 commits since v4.5.2.
... so, you might want to grab a coffee! ☕️
nuxt/serverIt has been asked for for a long time, and it now exists (#36275)!
nuxt/serveris a new import source for server code: handlers, middleware and utilities - a complement tonuxt/app. Wherenuxt/appis for the part of your application that also runs in the browser,nuxt/serveris for the part that only runs on the server.import { defineEventHandler, getQuery } from 'nuxt/server' export default defineEventHandler((event) => { const { name } = getQuery<{ name?: string }>(event) return { message: `Hello, ${name ?? 'world'}!` } })The utilities use web standards and are typed against a portable
RequestEvent:event.req // Request event.url // URL event.res // { status, statusText, headers } event.res.headers // Headers event.context // per-request contextUnder
@nuxt/nitro-serverthey are backed by Nitro and h3, but you never import from either.So the same handler runs under Nitro v2, Nitro v3 or
@nuxt/vite-server, and a module that imports fromnuxt/serverdoesn't need a peer dependency onh3ornitropack.We think this will make a big difference in smoothing out the upgrade to Nuxt v5 and Nitro v3.
There is a typing benefit too. We no longer hoist h3 or Nitro types into your app to type
useRequestEvent,$fetchor route rules, which removes a source of type conflicts when versions differ (#36212, #36214, #36293).The surface is small, and covers what published modules and user code typically need:
defineEventHandler,createError/isNuxtError, request URL, headers, query, body (plain and validated with any Standard Schema library or a function), cookies, redirects, response status,getRouterParam(s),getRequestIP,handleCors,getRouteRules,useRuntimeConfig,useAppConfigand sessions.import { defineEventHandler, readValidatedBody } from 'nuxt/server' import { z } from 'zod' export default defineEventHandler(async (event) => { const user = await readValidatedBody(event, z.object({ name: z.string() })) return { created: user.name } })We encourage you to use web APIs (
event.req.headers, for example), or raise an issue if there's functionality you're missing fromnuxt/server🙏If you do need to step outside
nuxt/serverfor a particular handler, don't worry! Nothing has been taken away: importdefineEventHandlerand the helpers you need fromh3ornitropack/runtimeas before, and that handler works exactly as it did on Nuxt 4.5.import { defineEventHandler, readMultipartFormData } from 'h3' export default defineEventHandler(async (event) => { const parts = await readMultipartFormData(event) return { received: parts?.length ?? 0 } })[!IMPORTANT]
On Nuxt 4, the auto-importeddefineEventHandler,getQuery,readBodyand the rest are still h3's own helpers, which take a different shape of event. Import fromnuxt/serverexplicitly, includingdefineEventHandlerto use the new server runtime. If you mix the two, you'll see aNUXT_E8012error which should tell you which import to change.A few helpers also behave differently from their h3 v1 namesakes:
sendRedirectreturns the response rather than sending it,createErrortakesstatusandstatusText, and response headers are set throughevent.res.headers. The upgrade guide has a table of the differences.Nothing in this release requires a migration. But if you have server code you'd like to make portable ahead of Nuxt 5, this is the best way.
👉 Read the server imports guide.
appSecretand sessionsNuxt now has a root application secret:
runtimeConfig.appSecret, set withNUXT_APP_SECRET(#35874, thanks to @onmax). Modules and server features derive purpose-specific secrets from it withderiveSecret(purpose), soNUXT_APP_SECRETis the only secret you need to configure.openssl rand -base64 32
In development Nuxt generates and persists one if none is configured (and warns the first time a derived secret is used). Builds never generate one.
The first thing to use it is a set of session helpers in
nuxt/server(#36358). Sessions are sealed into a cookie with iron, so there's no server-side storage to configure:import { defineEventHandler, useSession } from 'nuxt/server' export default defineEventHandler(async (event) => { const session = await useSession<{ visits: number }>(event) await session.update(data => ({ visits: (data.visits ?? 0) + 1 })) return { visits: session.data.visits } })[!NOTE]
As a reminder, runtime config keys prefixed withapp(runtimeConfig.app,runtimeConfig.appSecret) are reserved for Nuxt.Typed
$fetch, rebuilt$fetchanduseFetchhave been typed from your server routes for a long time. But the types were derived from Nitro'sInternalApiinterface, and past a few hundred routes they hit TypeScript's instantiation limit with the familiarTS2589: Type instantiation is excessively deep and possibly infinite.We've rebuilt typed fetch on top of
fetchdts(#36238). Nuxt compiles your server routes into a route tree with an exact-match table for static paths and accessors specialised to your route set. Resolution cost now scales with call sites, not with route count:routes before after 100 1,397,361 instantiations / 0.77s 51,558 / 0.26s 300 5,774,425 / 3.49s ( TS2589)51,558 / 0.16s 1000 12,831,467 / 7.44s ( TS2589)51,558 / 0.20s 3000 (200 call sites) 71,875,148 / 53.63s ( TS2589)101,678 / 0.62s Peak memory for the same runs dropped from 946 MB to 140 MB. 🔥
Plus, the route set also carries the
body,queryandheadersa handler validates, so calls are checked more tightly than before:// server/api/users.post.ts validates { title: string, count: number } await $fetch('/api/users', { method: 'post', body: { title: 'a', count: 1 } }) await $fetch('/api/users', { method: 'post', body: { title: 'a', count: 'no' } }) // ^ not assignable to number await $fetch('/api/users', { method: 'post' }) // ^ body is requiredOn Nuxt 4 this is opt-in, because there are small changes to type inference, and hand-written
ServerRoutesaugmentations need a small rewrite. It is the default in Nuxt 5.export default defineNuxtConfig({ experimental: { routeTypedFetch: true, }, })There's also a new
experimental.strictRouteTypesoption to reject calls to paths that don't exist (otherwise these just returnunknown), and an'isomorphic'mode that types your pages asGETroutes too if you want to be able to$fetchfrom the Vue renderer with type safety.👉 Read more in the experimental features docs.
Better errors in development with
my-badServer-side errors in development used to look like this:
ReferenceError: foo is not defined at Object.<anonymous> (/_nuxt/app/pages/index.vue:1:1)There was no source position or code frame, and the Youch iframe we rendered could not show you the frame in your own source either. Both are now fixed (#36258, nuxt/cli#1518).
Dev SSR stack traces are now mapped before anything reads the error, and the Youch overlay has been replaced with
my-bad. It renders into your app's own error page as an overlay (or as a standalone page when the app can't render one), with the mapped stack trace and a code frame from your source, and the same report is printed in your terminal. We are still working with @atinux, @HugoRCD and @antfu to make these pages nicer still.With Nuxt CLI v4, there is a single live error channel at the CLI level. It survives worker restarts, so (for example) a syntax error in
nuxt.config.tswill live-reload the page once you fix it. Each error is rendered once rather than at every layer it passes through, and the same channel streams build progress and app logs to the dev panel.A new loading screen, 404 and error pages
@HugoRCD has redrawn the loading screen you see while the dev server starts. It is now a WebGL2 particle field that traces a mountain range behind the Nuxt lockup (#36178), using a single shader and a single draw call. Without WebGL2 it falls back to the static lockup, and with
prefers-reduced-motionthe animation stops. Try hovering over it. 🏔️Hugo also gave the built-in 404 and error pages a neutral palette and lighter type (#36255), and @MirkoJa added a back button to the 404 page (#35688).
Vue Vapor support
Nuxt now supports Vue 3.6's Vapor Mode in interop mode (#35759). Your app root stays on the virtual DOM, and you can opt individual components or pages into Vapor by adding the
vaporattribute to<script setup>:export default defineNuxtConfig({ vue: { vapor: true, }, })<script setup vapor lang="ts"> const count = ref(0) </script> <template> <button @click="count++"> count is {{ count }} </button> </template>Routing,
useAsyncData, layouts and most built-in components keep working unchanged. Along the way we made the auto-import loader,useAsyncData,definePageMetaand slot inspection Vapor-aware, and we now have a Vapor test suite so we can track what's supported.[!NOTE]
This requires Vue^3.6.0-rc.2or newer. See the known limitations and try it in a fresh project first.Addons for
useFetchanduseAsyncData@cernymatej has added an
addonsoption to thecreateUseFetchandcreateUseAsyncDatafactories (#35797). An addon can declare custom call-site options, adjust the merged options, wrap the handler with middleware, and extend what the composable returns, and it can be reused across as many custom instances as you like.const refreshOnFocus = defineUseFetchAddon({ setup: (options: UseFetchAddonOptions<{ refreshOnFocus?: boolean }>) => { if (import.meta.server || !options.refreshOnFocus) { return } return (asyncData) => { const focused = useWindowFocus() watch(focused, focused => focused && asyncData.refresh()) return { focused } } }, }) export const useApiFetch = createUseFetch({ baseURL: '/api', addons: [refreshOnFocus] })<script setup lang="ts"> const { data, focused } = await useApiFetch('/todos', { refreshOnFocus: true }) </script>This resolves a long list of feature requests for
useAsyncDataanduseFetch(refresh on focus, polling, retries, auth headers and more) without making the core composables opinionated about any of them.👉 Read about
defineUseFetchAddonanddefineUseAsyncDataAddon.Performance
There is a lot of performance work in this release.
<NuxtLink>renders 58% faster on the server (#36015). Internal links are now rendered as a plain<a>with nouseLink, no computed and no reactive state. Rendering 200 links went from 1.36ms to 0.57ms, which is 1.4x faster than a bare<RouterLink>.Early 404s (#36117). With
experimental.early404, page routes are compiled into a static matcher at build time and requests that can't match any page skip creating the Vue app, running plugins and middleware entirely. On an app with 30 pages and ~23ms of boot work per render, a JSON 404 went from 37.1ms to 0.3ms.Templates declare their dependencies (#35875). The virtual file templates used in Nuxt's build used to regenerate on every file change. They now declare what invalidates them, so editing a component regenerates 0 of 49 core templates instead of all of them, and the
builder:watchhook settles in 0.6ms instead of 36ms.Cookie jars (#36114).
useCookieparses the cookie header once per request (or once per microtask on the client) instead of on every call. A nice side effect: a cookie set in a plugin during SSR can now be read by a lateruseCookiein a page.ssr: falsepages are tree-shaken from the server bundle (#35836, thanks to @Austin1serb).Serializable
definePageMetakeys are extracted at build time (#35919), behindexperimental.extractSerializablePageMeta.Faster dev server warm-up: Vite's server module graph is warmed before the client (#36154), the client graph is crawled during warm-up (#35870), and warm-up yields to your first navigation so it never competes with a real request (#36412).
Smaller client bundle:
unctxis no longer shipped to the browser anddefuis skipped for a singleapp.config(#36371).Fewer dependencies:
@nuxt/kitno longer depends onc12,untyped,confbox,pkg-types,ufoormlly, andjitiandgigetare now optional peers loaded only when needed (#35936, #35943, #35946, #36071, #36073, #36083).Lazy impound tracing for builds (#36172), virtual module hooks filtered by id (#36077),
isVuechecks migrated to plugin filters (#36116) and anflruprerender cache (#36340).
Put together, on our benchmark machine (arm64 Linux, Node 24.15, medians of 5 runs):
v4.5.2 v4.6.0 @nuxt/kitinstall size6.4 MB 2.1 MB -67% @nuxt/kittransitive dependencies36 22 -39% nuxt build, starter4.4 s 3.6 s -18% nuxt build, 200 pages / 200 components / 50 routes11.6 s 10.3 s -11% SSR throughput, page with 300 <NuxtLink>s110 req/s 140 req/s +26% Dev server start-up (spawn to first HTML) on the same machine is about 12% faster on a starter app, with the second request served in roughly half the time, though the CLI major changed alongside so not all of that is Nuxt.
Lighter payloads
useAsyncDataanduseFetchaccept aserialize: falseoption to keep data out of the__NUXT_DATA__payload (#35779). That's most useful inside components that never hydrate, andexperimental.stripNeverHydratedDataapplies it automatically to data fetched withinhydrate-nevercomponent trees.Nuxt also warns in development when a page's payload exceeds 100 kB (#35777) and when a route rendered with
noScriptsrelies on client-side JavaScript (#35780), andnoScriptspages keep their non-script resource hints and attach their styles correctly (#35803, #36356, #36359).<NuxtLink>now prefetches server-page islands (#35808), and @atinux made prefetch hints throttled and prioritised so a page full of links doesn't flood the network (#36261, #36324). Building on that, route chunks, layouts, middleware, payloads, islands and resource hints all now go through one client prefetch scheduler with per-kind concurrency caps, deduplication by key, and cancellation of in-flight work when you navigate away (#36391).Nuxt 5 features, today
Most of what's new in Nuxt 5 is already in 4.6, either as the default or behind a flag.
future.compatibilityVersion: 5turns on the Nuxt 5 defaults in one go, and every one of them can be enabled (or disabled) individually.export default defineNuxtConfig({ future: { compatibilityVersion: 5, }, })Newly gated behind the flag in this release:
Typed pages (
experimental.typedPages)Typed
$fetch(experimental.routeTypedFetch), described aboveCase-sensitive routing, matching Nitro (#35650, thanks to @Mateleo)
Early return from
navigateTo(experimental.navigateToEarlyReturn):navigateToin<script setup>short-circuits the rest of the setup, so redirects and 404s don't throw on missing dataSerializable page meta extraction (
experimental.extractSerializablePageMeta)Client-side payload extraction (
experimental.payloadExtraction: 'client')Normalized page names,
clearNuxtStateresetting to defaults,experimental.watcher: 'builder', and no auto-imported server-only head composablesNo
baseUrlin generated tsconfigs (#36040, thanks to @oritwoen)Inline error rendering (
experimental.inlineErrorRendering): when a server render fails,error.vueis rendered in the same request with a plain try/catch, instead of re-entering the server over an internal request to/__nuxt_error. Headers and cookies the failed render had already set are kept, error renders no longer pass through Nitro middleware and route rules a second time, andrender:htmlfires with the original event (#36399).
The upgrade guide now lists exactly what the flag changes on Nuxt 4.
Experimental:
@nuxt/vite-serverSince v4.2
server.builderhas been configurable. This release adds a second server builder:@nuxt/vite-server. It builds a Nuxt app with Vite alone (#36218, #36279, #36288).This is all you need to do to configure it.
export default defineNuxtConfig({ server: { builder: 'vite', // 'nitro' is the default }, })It can produce a pure client SPA, a server-rendered app with a small Node entry, a web-standard
fetchhandler for platforms that provide the server (there are e2e examples for Cloudflare Workers, Netlify and universal deploy), as well as fully static output withnuxt generate.Right now, this helps keep Nuxt's code agnostic, enforce the contract behind
nuxt/server, and to give Vite plugins that provide a deploy target something to build on. It does not have Nitro's full feature set (there is no storage, caching, tasks or server plugins), and we expect most apps to keep using Nitro. Nitro remains the default.[!WARNING]
This is highly experimental and the API will change.'nitro'and'vite'are new shorthands for@nuxt/nitro-serverand@nuxt/vite-server.Developer experience
Clickable file paths in terminal output (#35898). Warnings that mention a file now link to it in your editor, at the line responsible where we know it.
IDE hover docs for built-in components (#35701). Hovering a built-in component like
<NuxtLayout>or<NuxtLink>in a template now shows a short description and a link to the docs. Thanks to @Ibochkarev.app/types/andserver/types/are included in the right tsconfig, so ambient types and augmentations placed there are picked up (#35783, thanks to @Flo0806, who also added an augmentableNuxtPageMetafor typingNuxtPage.metain #34816).Grouping folders in
components/: a(group)/folder is excluded from the component name (#35699, thanks to @abaza738).Dynamic
expiresinuseCookie, accepting a function (#35628, thanks to @DarlanPrado).A warning when a
public/file shadows an application route (#35674, thanks to @Norbiros).Install hints use your package manager (#35871).
Prerender your error pages as real HTML (
404.html, or any status codes you pass) withexperimental.prerenderErrorPagesinstead of an empty SPA shell (#35193, thanks again to @Flo0806).$Fetchis exported fromnuxt/app(#35625) andShallowRefis in the Vue auto-import preset (#36266), both from @DamianGlowala;preloadComponentsand theNuxtIslandnameprop are typed (#35775), anduseLayout,useLoadingIndicatoranduseRequestHeaderare exported fromnuxt/app(#36033).typescript.tsConfigis now a shared baseline for all four generated tsconfigs, withappTsConfigandserverTsConfigfor per-context overrides (#35697, thanks to @chairulakmal).Top-level
prerenderoption, an alias fornitro.prerenderin the same wayruntimeConfigandrouteRulesare top-level (#32356). Nuxt now also points you towards top-level options where they exist, since those work across server builders (#36416).Links to
public/files just work. If the router has no route for a<NuxtLink>target (a PDF inpublic/, say, or a link from Markdown with Nuxt Content), Nuxt falls through to a full-page load instead of rendering your 404, soexternalis no longer required (#36169).Renaming a component in development refreshes its imports, so you no longer see stale references to the old file (#36165, thanks to @oritwoen).
Layers: dependencies of layers installed from
node_modulesare pre-bundled by Vite (#36208), and symlinked layer directories resolve to their real path (#36402, thanks to @silverbackdan).
For module authors
If you maintain a module with server code, we've enabled making modules compatible with both Nuxt 4 & 5, without requiring a major bump. (And we'll be opening PRs proactively after the release of Nuxt v4.6 to assist with preparing for a Nuxt v5 release...)
One module for Nuxt 4 and Nuxt 5.
addServerHandler,addDevServerHandlerandaddNitroPluginaccept a map of variants per server API (#36317). Nuxt chooses the most appropriate one. A handler that imports only fromnuxt/serverneeds no Nitro 2/3 variants at all (but does require Nuxt v4.6+).addServerHandler({ route: '/api/my-module/status', handler: { nuxt: resolve('./runtime/server/status'), nitro2: resolve('./runtime/server/status.legacy'), }, })Nuxt reads the file's imports to decide which API it uses. Where that isn't enough, you can declare
meta.compatibility.server.getNitroVersionandhasNitroVersionare also there in case you have logic that explicitly requires you to know the Nitro version installed (#36127).👉 Read the server compatibility guide for more information.
Nuxt-owned, augmentable server types:
ServerTypes,ServerRoutes,AppRouteRulesandNuxtRequestContext. Augment@nuxt/schemaonce;nuxt/schemamirrors it (#36293).useTerminalfor host-aware prompts, status messages and tasks in progress, rendered by the CLI's dev panel when there is one (#36162).module:beforeandmodule:donehooks, which Nuxt CLI v4 uses to show per-module setup time as it happens (#36173).onConfigResolvedanddiffNuxtConfigto see what changed between two config loads (#35853).ensureDependencyInstalledandgetAddDependencyCommandto check for and offer to install optional dependencies with the user's package manager (#34554).Template
dependenciesto say exactly what should invalidate a template (#35875).addServerImports,addServerImportsDirandaddServerTemplatework the same across Nitro versions; a server tsconfig and versioned route config types are generated for you (#36265).@nuxt/kithas an explicit public API (#36074) and@nuxt/schemais an optional peer (#36246).Modules can now set
experimental.asyncContext(#36175, thanks to @cernymatej), Vite plugins added via kit land at the top level rather than wrapped (#36037), and more build-time warnings have moved to diagnostic codes with docs pages (#36138).@nuxt/kitpeer dependency ranges are widened to the versions actually required rather than tracking the latest of each package (#36417), andupdateRuntimeConfigno longer warns when called before Nitro exists (#36403, thanks to @Neekoras).
Security
- security
The internal error route is only served to an error render, and can no longer be reached from outside (259058cf4, #36305).
- security
Dev error reports are scoped for remote peers, and the dev error channel is kept out of production builds (#36389, #36407).
- security
Unhandled error data is no longer passed to the error page (38a40cfc0), oversized island bodies are drained before being rejected (#36320), and error-render recursion is tracked in request context rather than via a client-controllable header (d8c729435).
Important fixes
Awaited
useAsyncDatano longer resolves with unfetched data on hydration (#36124), awaited lazy async data resolves immediately (#36301), anduseAsyncDatatypes resolve for generic type params (#36316).useRequestFetchforwards request headers (#36180, thanks to @hdwebpros).navigateTomatches vue-router's path encoding (#36055), preserves percent-encoding in server redirects (#36112), and appliesbaseURLwithopen(#36197).Scoped styles apply to server component slots (#36047), island asset requests are deduped (#36048), lazy hydration no longer produces blank remounts (#36051), all from @oritwoen, and hydrated
nuxt-clientmarkup is stripped from cached island HTML (#36298).A batch of CSS fixes across Vite, webpack and rspack: duplicate CSS links for inlined chunks (#36056),
baseURLandurl()rewriting in inlined styles (#36137, #36143), island descendant CSS extraction (#36260) and stable style chunk names (#36361).View transitions handle interrupted and skipped navigations (#35537 from @Askerka00, #36314), and page transitions stay mounted for nested routes with no children (#36304).
The streaming shell head renders after the first render pass (#36120).
Payload URLs are parsed as origin-relative paths, so a path like
//x/_payload.jsonno longer serves the wrong payload (#36409, spotted/index.htmlis prerendered for client-only apps with islands (#36299).definePageMetaworks at the top level ofsetup()(#36245), and changed auto-import sources are rescanned before their consumers (#33671, thanks to @Flo0806).A template that never finishes compiling now fails the build instead of exiting 0 (#36322).
Error causes are preserved in development (#35632, thanks to @onmax).
Layout
onBeforeLeavereuses the pending transition promise (#36395), andbaseURLand middleware flags are respected in apps withoutpages/(#36034).stripNeverHydratedDatano longer mutates the options object (#36035), the dev error module is stubbed out of production builds (55e61d75d), and preloading a component that is not global now warns (47de80ece).
Upgrading
Our recommendation for upgrading is to run:
npx nuxt upgrade --dedupe
This will refresh your lockfile and pull in all the latest dependencies that Nuxt relies on, including Nuxt CLI v4.
[!NOTE]
This release requires Node.js^22.22.3 || ^24.15.0 || >=26.0.0.If you have server code you'd like to make portable, read Moving to
nuxt/serverin the upgrade guide.Changelog
Enhancements
kit: add
resolveServerVariant+addServerImportsvariant supportnuxt: add addon support to
createUseFetchandcreateUseAsyncDatavite-server: back
serverFetchand route rules innuxt/servernuxt,nitro,schema: add
useServerHookstonuxt/servernuxt,nitro: add
serverFetchtonuxt/servernuxt,nitro: add forwarded url, cookie and route rule helpers to
nuxt/servernuxt,vite: add
hook,bundlerandmiddlewaretracing channelsnuxt: serve unmatched public asset paths on client-side navigation
nuxt,schema: add top-level
prerenderalias fornitro.prerendernuxt,vite-server: render the error page in the renderer itself
nuxt: unified client prefetch scheduler
nuxt: add
useAppConfigtonuxt/servernuxt: add
handleCorstonuxt/servernuxt: add
readValidatedBodyandgetValidatedQuerytonuxt/servernuxt: add
getRouterParam(s)andgetRequestIPtonuxt/servernuxt,nitro,vite,vite-server: scope dev error reports for remote peers
nitro,vite: map dev ssr stacktraces and render errors with
my-badui-templates: use neutral palette and lighter error type
ui-templates: particle mountain loading screen
nuxt: add session utils to
nuxt/servernuxt,schema: add nuxt
appSecretnuxt: add server + client cookie jars to avoid unnecessary reads
kit,nitro,schema: register server handlers and plugins per server API
nuxt,nitro,vite-server: compile nuxt core route rules
vite-server: support
nuxt generateprerenderingkit,schema,vite-server: render in a target's own env (+ add e2e tests)
nuxt,schema: give
nuxt/serverhandlers a portable eventnuxt,kit,schema,nitro,vite-server: add
nuxt/serverkit: add a server tsconfig and versioned nitro route config types
nuxt: add
ShallowReftype to vue presetnuxt: type
$fetchanduseFetchfrom generated server routeskit,nuxt,vite,vite-server: add experimental pure vite server
kit,schema: add
module:before/module:donehookskit: add
useTerminalfor host-aware prompts and tasksnuxt: add experimental early404 for unmatched page routes
nuxt: add experimental early return after
navigateTokit: nitro version utils + version-tagged server utils
nuxt: support vue vapor
nitro: allow prerendering error page
nuxt: use @nuxt/cli v4 prerelease
nitro,nuxt: improvements when rendering with
noScriptskit,nitro,nuxt,rspack,vite,webpack: use package manager in hints
nuxt: make file names clickable 🖱️
nitro: warn in dev when noScripts routes rely on client JS
nitro,nuxt,schema: let templates declare dependencies
nuxt: prefetch server page islands via
<NuxtLink>kit: expose resolved config snapshot and diff helper
nitro: warn in dev when payload exceeds 100 kB
nuxt,nitro: auto-import types from
app/typesandserver/typesdirectoriesnuxt: type
preloadComponentsandNuxtIslandnameschema: enable
typedPageswithcompatibilityVersion: 5nuxt: add
serializeoption to keep async data out of payloadui-templates: add back button on 404 page
kit: easier way to define global
tsConfigoptionsnuxt: log template write paths when debugging
nuxt: export
$Fetchtypenuxt: add IDE hover docs for built-in components
nuxt: support grouping folders in component directories
schema: add augmentable
NuxtPageMetainterface forNuxtPage.metanuxt: warn when public files override application routes
nuxt: support dynamic
expiresinuseCookieschema: case-sensitive routing by default in v5
Performance
kit: use
package-manager-detectorto install packagesvite: stop serial-build warmup on first navigation
vite: evaluate ssr entry before the first dev render
vite-server: index public files only once
nuxt: drop
unctxfrom client environment (+defuin single-object config)nitro: use
flrufor prerender cachenitro,nuxt: use lazy impound tracing for builds
vite: warm the server module graph before the client
nuxt,vite: migrate
isVuecalls into plugin filterskit: remove
confboxandpkg-typesfrom dependenciesnuxt: filter virtual module load hooks by id
kit: drop
ufodependencykit: use
microdiffandnode:cryptonuxt: render internal
<NuxtLink>anchors directly on servernuxt,kit: avoid loading
jitiunless it is needednuxt: tree-shake
ssr: falsepages from server bundlenuxt: extract serializable
definePageMetakeys at build timevite: crawl client module graph when warming dev server
Fixes
nuxt: resolve anchor hrefs through the router
nuxt: leave a newer async data entry alone when an old one is taken off
nuxt: await async layouts before navigation
nuxt,vite: show compile error overlay on client-only pages
schema,vite-server: accept
nullfrom prerender ignore functionsnuxt: keep
CookieOptionscompatible with cookie serialize optionskit: point
NUXT_B1022at resolving templates before bundlingkit: only write missing types when building into a relocated build dir
kit,nuxt: preserve types when building into a relocated build dir
nuxt,nitro: render html page errors + json server route errors
nuxt,vite-server: keep cookies + respond to json clients on errors
vite,nitro: rewrap console if build throws
kit,nuxt: provide
nuxt/internal/dev-erroras a server runtime modulenuxt: allow
@nuxt/cliruntime imports in server runtimenuxt: type nitro type path helper with
NitroConfignuxt: refresh component imports after rename
nuxt: skip browser notices without error in dev overlay
kit: widen peer dependency ranges to supported versions
- deprecated
schema: deprecate
nitro.*options duplicated at the top level vite: pre-bundle deps of layers installed in
node_modulesnuxt: respect base URL and clear middleware flags without
pages/(#36034)\nuxt,nitro: stub dev error module in production builds
nitro: do not warn for public asset dirs generated in the build dir
nuxt: resolve
@nuxt/*type paths from nuxt's own resolutionnuxt: warn when preloading a component that is not global
nitro: resolve nitro dependency types from the copies nitro uses
nuxt: avoid mutating options when stripping never-hydrated data
kit: do not warn when updateRuntimeConfig runs before nitro exists
kit: resolve symlinked layer directories to their real path
nuxt: reuse pending transition promise in layout
onBeforeLeavevite: keep named compile report over nameless hmr payload
nuxt: reject sealed values not issued by nuxt sessions
nitro,vite: sort prerendered routes in app manifest
nuxt: parse payload url as origin-relative path
nitro: explain when an h3 event reaches a nuxt/server helper
nuxt: invalidate auto-import consumers on the hmr-less ssr dev server
nitro: give the portable event's response headers the full
Headersinterfacenuxt: accept
Endpoint-shapedServerRoutesaugmentations in theInternalApienginenitro: keep dev error channel out of production builds
nuxt: share client app context across module instances
nitro: resolve path placeholders in nitro preview command
nitro: extend nitropack runtime app config with nuxt fields
nitro: detect an http error by brand in the dev error handler
nuxt: explain nitro 2 env parsing when a derived secret is unusable
nuxt: prepend the vite unctx transform so it reaches page-meta macro modules
nitro: renumber duplicate NUXT_E8009 diagnostic code
vite: await
ssrFixStacktracevite: keep deduped packages out of importer-based external resolution
nuxt,vite: attach resources to pages served without scripts
vite: share a style chunk-name counter across component extractions
nuxt: keep non-script resource hints on
noScriptsroutesnuxt: strip hydrated
nuxt-clientmarkup from cached island htmlnuxt: widen
nuxt/serverhelper event typesnuxt: keep a configured appSecret and warn when it is used
nuxt: keep session managers in step after
clearSessionnuxt: use a throttle approach for hint prefetching
kit: normalise method case when checking for duplicates
kit: respect method when checking for existing handlers
kit: register the base path of a wildcard route on nitro v2
nitro: render streaming shell head after first render pass
vite: skip client manifest finalisation for aborted builds
nitro: apply server replacements to prerenderer
kit,nuxt,schema: let a server build declare the module backing
fetchkit,nitro: follow host nitro major in server build runtime fallback
nuxt: apply nitro type paths in
prepare:typesin devnuxt: forward request headers with
useRequestFetchnitro: serve repeated reads of a
nuxt/serverrequest bodynitro: write registered server plugins into the nitro config
nuxt: resolve awaited lazy async data immediately
nuxt: resolve
useAsyncDatatype for generic type paramsnitro: drain oversized island body before rejecting it
kit,nuxt: fail the build when a template never finishes compiling
nitro: buffer the body read through a
nuxt/servereventnitro: scan a layer's server utils before the project's
nitro: pass glob patterns to devStorage fs watch ignore
nuxt: keep view transition state for interrupting navigations
nuxt: handle rejected
readypromise of skipped view transitionnitro: serve the internal error route only to an error render
nitro: guard internal error render on request context
vite: resolve bare ssr externals from their importer
nitro,vite-server: render
error.vue404 when accessing/__nuxt_errornuxt: skip scanning page meta if the scanner cannot parse
nitro: prerender
/index.htmlfor client-only apps with islandsnuxt: keep page transition mounted for nested route with no children
nuxt: respect image prefetching as preload to respect Accept hea…
nuxt: listen to
link:prefetchhook before onNuxtReadyvite: let the app build serve a server build that is not its own pass
vite: let a server build that is not its own pass reach the app entry
nitro: load
nitropackin any program that augments itkit,nitro,schema: derive the fallback server runtime from the host nitro major
nitro: do not pass unhandled error data to error page
kit: declare
@nuxt/schemaas an optional peer dependencykit,nuxt,schema,vite-server: let vite plugins own the deploy target
nuxt: avoid app config declaration conflicts
nuxt: rescan changed auto-import sources before their consumers
rspack,webpack: do not serve server bundle from dev server
vite: extract css of island descendants when inlining is off
kit: explicitly include
.vueand other extensions tsconfigsnuxt: resolve layout hydration guard when unmounted early
nuxt: bound island v-for on nuxt-client elements without selectiveClient
nuxt: only rewrite island uid marker in attribute position
nuxt: serialize numeric v-for island slot scopes 1-based
nuxt: support
definePageMetaat the top level ofsetup()nuxt: make
targetoptional if callingnavigateTow/ openvite: exclude stable entry chunk from preload dependencies
nuxt: apply
baseURLwhen callingnavigateTowithopennuxt: expose shallow async data ref
nuxt: ignore grouping folders when collapsing repeated name segments
nuxt: register namespace binding alongside default import
nuxt: keep extracted
__proto__page meta keys as own propertiesnuxt: disable early 404 for page paths that cannot be decoded
nitro: resolve aliases and rootDir-relative asset dirs
nuxt: key dynamic meta by file path + nuxt instance
schema: keep
nuxt/schemaaugmentation bridge out of bundled typeskit: forward
configFileandrcFileto config loadernuxt: validate component export name before code generation
nuxt: allow modules to set
experimental.asyncContextschema: type
import.meta.envasImportMetaEnvkit,nitro,schema: ensure tsconfigs exist before build
schema,nuxt: accept partial app config input + stop merging functions
ui-templates: mark the loading page's poll as a document request
ui-templates: back off the loading page's poll
vite: rewrite every public asset
url()in CSSvite: apply
baseURLto public assets in inlined stylesnuxt: resolve layout name override in layout
isCurrentchecknuxt: bridge
AppConfigInputaugmentations intonuxt/schemanuxt: don't resolve awaited
useAsyncDatawith unfetched data on hydrationnuxt: preserve percent-encoding in server
navigateToredirectsnuxt: preserve regexp and function values when cloning import presets
nitro: match exact nonce attribute for streaming CSP nonce
nuxt: pass absolute paths to build cache ignore check
nitro: preserve overlapping dynamic payload rules
kit: retry CJS-global and alias load failures through jiti
rspack,webpack: respect inlineStyles predicate for global css
rspack,webpack: do not search filesystem for postcss config
rspack,webpack: keep url() wrapper when rewriting inlined styles
nuxt: hide internal dynamic page meta key behind a symbol
nuxt: keep page bundle restrictions out of the pages array
nuxt: avoid duplicate island asset requests
kit: reorder diagnostics by code
kit: retry nested load failures through jiti
nuxt: keep
<NuxtTime>locale prop reactive after hydrationnuxt: validate
scopeIdprop passed to<NuxtIsland>vite,nitro: keep css links for unrendered components
nuxt: apply scoped styles to server component slots
kit,nitro: ignore baseUrl with compatibilityVersion 5
nitro: in dev, only add css for islands actually rendered
vite: drop duplicate CSS links for fully inlined shared chunks
nuxt: match vue-router path encoding in
navigateTonuxt: avoid blank lazy hydration remounts
nuxt: don't defer hydration route for trailing-slash-only diffs
kit: add vite plugins at top level instead of wrapping them
nuxt: keep ref-initialised
useStateconnected to payload statenuxt: only compute
distURLin developmentnuxt: export
useLayout,useLoadingIndicatoranduseRequestHeadervite: recover throttled watcher changes in dev servers
nuxt: only map test components for webpack and rspack
nuxt,nitro: unwrap route rule matches when resolving rules
nuxt: stub client-only components + map test components in server build
nuxt: do not write readonly cookies on client
nuxt: skip cookie watcher entirely when readonly
nitro,nuxt: hoist route matcher to prevent temporal dead zone
nuxt: resolve
ufofrom nuxt dependenciesnitro: resolve paths pointing at bare module specifiers
nuxt: preserve error causes in development
nuxt: improve js type-checking
Refactors
- removed
nuxt: remove
config.cjsfile inrequireexport
4.5.2
5 Aug 2026nuxt,kit: Skip rewriting unchanged generated files
kit,nuxt: Use lazy imports to improve parsing speed
vite: Skip html entry probes in bare-import resolver
4.5.2 is the next patch release.
Changelog
Performance
nuxt,kit: Skip rewriting unchanged generated files
kit,nuxt: Use lazy imports to improve parsing speed
vite: Skip html entry probes in bare-import resolver
nuxt: Reuse app and component scans for unchanged structures
Fixes
vite: Resolve client manifest path from resolved config
nuxt: Use client-side navigation for links inside islands
nuxt: Generate types for route params defined with definePageMeta
nuxt: Serialize island payloads for components with underscores in keys
nitro: Dedupe island renders when prerendering
nuxt: Drop prefetch hints for never-hydrated chunks
vite: Use same asset filenames for worker builds
nitro: Reject non-object island props
nuxt: Support options api in
v-forislands transformnuxt: Improve page meta extraction + performance
nuxt: Set build outputs when restoring vue cache
kit: Honour nested
applyandapplyToEnvironmentin vite wrappernuxt: Re-check for preview mode after prerendered page hydration
kit,nuxt,vite: Handle missed chokidar watch events
nuxt: Settle asyncData status when bailing
kit: Clone resolved config with klona rather than klona/full
kit: Honour nested plugins'
enforcein vite wrappernuxt: Collect build cache once build outputs are final
vite: Resolve vite env api sourcemaps in
vite-nodenuxt: Don't warn about missing
<NuxtPage>on nav + with slotkit: Prepend vite environment wrapper plugin when
prependis setnuxt: Depend on rolldown as a peer to reuse vite's copy
nitro: Define
import.meta.testfor server codenuxt: Match route rules against decoded paths
4.5.1
27 Jul 2026nitro: Replace island teleports in a single html pass
nuxt: Add
vue.optionsApiand disable it for v5+nuxt: Without pages, skip client plugins that require routing
⚠️ This is a security release. We recommend upgrading as soon as possible with
npx nuxt upgrade --dedupe.It fixes server-side RCE and unauthorized component instantiation via server island props, a route rule authorization bypass, server component DoS, cross-user payload disclosure on cached pages, and dev server path disclosure. Refreshing your lockfile also pulls in
@nuxt/devtools@3.3.1, which fixes a separate critical development-only RCE.If you already upgraded for the earlier route rule advisory (CVE-2026-53721), you still need this release: one of the fixes addresses a regression introduced by that fix.
If you use the
cache,swrorisrroute rules, purge any CDN or edge cache after upgrading; a leaked_payload.jsonmay already be cached upstream.Full details: Nuxt Security Patch Releases and GitHub Security Advisories.
Changelog
Performance
nitro: Replace island teleports in a single html pass
nuxt: Add
vue.optionsApiand disable it for v5+nuxt: Without pages, skip client plugins that require routing
nuxt: Skip payload revival plugin when
ssr: false
Fixes
nitro: Read rspack dev output fs lazily for server entry
rspack,webpack: Resolve loaders and runtime deps from nuxt dirs
nuxt: Return global route for
useRoutein detached effect scopenuxt: Ignore custom
nameorpathwhen reusing an existing page inpages:extendnuxt: Render client components in nested server components
nuxt: Preserve explicit
useFetchmethod inferencenuxt: Revalidate cached route payloads instead of using
force-cachenuxt: Correct default export detection in plugin metadata
nuxt: Clear hide/reset timeouts in set()
kit,nuxt,rspack,schema,webpack: Add
.mtsfile extension in resolvernuxt: Preserve trailing slash in NuxtLink href when unset
nuxt: Don't cross-pollute useAsyncData cache on reactive key change
nuxt: Filter plugin dependencies by build target
nuxt: Reload real page module on HMR of JSX render-function pages
nuxt: Resolve
@unhead/vue/*from nuxt's dependency treekit: Surface module load errors instead of masking as missing
nuxt: Type auto-imported
$fetchwith nitro's$Fetchnuxt: Don't reference app config sources in shared and node tsconfigs
vite: Resolve SSR inlined CSS module class name mismatch
nuxt: Generate layout types even when pages module is disabled
nitro: Skip resource hints for stylesheets already rendered as blocking links
kit: Dedupe layers that are both auto-scanned and explicitly extended
nuxt: Don't apply scroll behaviour after a subsequent nav
vite: Ensure server sourcemap-preserver plugin actually runs
vite: Preserve css suffix when extracting ssr inline styles
nuxt: Watch external component directories in development
nuxt: Don't exclude client entry module from style extraction
nuxt: Amend cleanup command in NUXT_B7014 error message
nuxt: Only pull in
vue-routerwhen there are island pagesvite: Suppress external warnings for internal vite-node paths
nuxt: Use scope-aware oxc parser for auto-imports
nuxt: Sync layout meta during middleware on SSR
nitro: Add alias for
h3that pins it to the version nuxt depends onnuxt: Preserve query params in cached payload extraction
nuxt: Mirror runtime route tree in generated typed-router types
nuxt: Warn when an imports preset
fromcannot be resolvedkit: Avoid mutating layer configs when resolving options
nuxt: Convert inline route rules exactly or drop with a warning
nitro,nuxt,vite: Dedupe and normalise global css links in dev
vite: Register template HMR plugin on dev servers
nuxt: Remove dev error overlay when error is cleared
rspack,webpack: Resolve bundled postcss defaults from builder
schema: Normalise slashes in
app.buildAssetsDirnitro: Bound island props and v-for to prevent unauthenticated DoS
nitro: Confine runtime payload cache to prerendering
nuxt: Case-fold route rule keys to match folded lookups
nitro: Require loopback peer for chrome devtools workspace endpoint
nuxt: Reject reserved
templateisland prop under runtime compilernuxt: Reject top-level
asprop for islands
4.5.0
18 Jul 2026Reading the note…
4.4.8
8 Jun 2026Reading the note…
4.4.7
2 Jun 2026Reading the note…
4.4.6
18 May 2026Reading the note…
4.4.5
10 May 2026Reading the note…
4.4.4
29 Apr 2026Reading the note…
4.4.2
12 Mar 2026Reading the note…
4.3.1
7 Feb 2026Reading the note…
4.3.0
22 Jan 2026Reading the note…
4.2.2
9 Dec 2025Reading the note…
4.2.1
6 Nov 2025Reading the note…
4.2.0
25 Oct 2025Reading the note…
4.1.3
6 Oct 2025Reading the note…
4.1.2
12 Sep 2025Reading the note…
4.1.1
5 Sep 2025Reading the note…
4.1.0
2 Sep 2025Reading the note…
4.0.3
5 Aug 2025Reading the note…
4.0.2
29 Jul 2025Reading the note…
4.0.1
21 Jul 2025Reading the note…
4.0.0
15 Jul 2025Reading the note…
- 3.x
3.21.11
5 Aug 2026nuxt: Serialize island payloads for components with underscores in keys
nitro: Dedupe island renders when prerendering
nitro: Reject non-object island props
3.21.11 is a patch release.
[!IMPORTANT]
Nuxt v3 is now end-of-life. Please upgrade to Nuxt v4, or you may wish to check out our partner HeroDevs who provide never-ending support for end-of-life releasesChangelog
Fixes
nuxt: Serialize island payloads for components with underscores in keys
nitro: Dedupe island renders when prerendering
nitro: Reject non-object island props
nuxt: Re-check for preview mode after prerendered page hydration
nuxt: Settle asyncData status when bailing
kit: Clone resolved config with klona rather than klona/full
nuxt: Use client-side navigation for links inside islands
nuxt: Match route rules against decoded paths
3.21.10
27 Jul 2026nuxt: Clear hide/reset timeouts in set()
nuxt: Preserve trailing slash in NuxtLink href when unset
vite: Resolve SSR inlined CSS module class name mismatch
⚠️ This is a security release. We recommend upgrading as soon as possible with
npx nuxt upgrade --dedupe.It fixes server-side RCE and unauthorized component instantiation via server island props, a route rule authorization bypass, server component DoS, and dev server path disclosure. Refreshing your lockfile also pulls in
@nuxt/devtools@3.3.1, which fixes a separate critical development-only RCE.If you already upgraded for the earlier route rule advisory (CVE-2026-53721), you still need this release: one of the fixes addresses a regression introduced by that fix.
Full details: Nuxt Security Patch Releases and GitHub Security Advisories.
Changelog
Fixes
nuxt: Clear hide/reset timeouts in set()
nuxt: Preserve trailing slash in NuxtLink href when unset
vite: Resolve SSR inlined CSS module class name mismatch
nuxt: Sync layout meta during middleware on SSR
nuxt: Update client URL to match SSR on fatal middleware error
nuxt: Watch external component directories in development
nuxt: Don't cross-pollute useAsyncData cache on reactive key change
nuxt: Return global route for
useRoutein detached effect scopenuxt: Ignore custom
nameorpathwhen reusing an existing page inpages:extendnuxt: Preserve explicit
useFetchmethod inferencenuxt: Correct default export detection in plugin metadata
nuxt: Reload real page module on HMR of JSX render-function pages
vite: Ensure server sourcemap-preserver plugin actually runs
nuxt: Resolve
@unhead/vue/*from nuxt's dependency treenuxt: Don't apply scroll behaviour after a subsequent nav
vite: Preserve css suffix when extracting ssr inline styles
nuxt: Don't exclude client entry module from style extraction
kit: Avoid mutating layer configs when resolving options
nuxt: Generate layout types even when pages module is disabled
nitro: Skip resource hints for stylesheets already rendered as blocking links
nuxt: Revalidate cached route payloads instead of using
force-cachenuxt: Preserve query params in cached payload extraction
rspack,webpack: Resolve loaders and runtime deps from nuxt dirs
nuxt: Render client components in nested server components
nuxt: Remove dev error overlay when error is cleared
rspack,webpack: Resolve bundled postcss defaults from builder
schema: Normalise slashes in
app.buildAssetsDirnuxt: Case-fold route rule keys to match folded lookups
nitro: Require loopback peer for chrome devtools workspace endpoint
nitro: Bound island props and v-for to prevent unauthenticated DoS
nuxt: Reject reserved
templateisland prop under runtime compilernuxt: Reject top-level
asprop for islands
3.21.9
18 Jul 2026Reading the note…
3.21.8
8 Jun 2026Reading the note…
3.21.7
2 Jun 2026Reading the note…
3.21.6
18 May 2026Reading the note…
3.21.5
10 May 2026Reading the note…
3.21.4
29 Apr 2026Reading the note…
3.21.2
12 Mar 2026Reading the note…
3.21.1
7 Feb 2026Reading the note…
3.21.0
22 Jan 2026Reading the note…
3.20.2
9 Dec 2025Reading the note…
3.20.1
6 Nov 2025Reading the note…
3.20.0
28 Oct 2025Reading the note…
3.19.3
6 Oct 2025Reading the note…
3.19.2
12 Sep 2025Reading the note…
3.19.1
5 Sep 2025Reading the note…
3.19.0
2 Sep 2025Reading the note…
3.18.1
5 Aug 2025Reading the note…
3.18.0
29 Jul 2025Reading the note…
3.17.7
13 Jul 2025Reading the note…
3.17.6
1 Jul 2025Reading the note…
3.17.5
3 Jun 2025Reading the note…
3.17.4
20 May 2025Reading the note…
3.17.3
12 May 2025Reading the note…