Packages

nuxt

4.6.2MIT
  • 4.6.2 is the latest, published 16 October 2026.
  • 21 security advisories, all fixed.
  • 4.x: 25 releases since 15 July 2025, 7 in the last 90 days.

Security advisories

Grouped by the version that fixes them, so one upgrade reads as one step.

3 older fixes

Releases in the last 90 days

Feed of releases and advisories

Every stable release, newest first. Notes are quoted as the maintainers published them.

  1. 4.6.2

    16 October 2026
    Compare changes

    v4.6.2 is the next patch release.

    Changelog

    compare changes

    Fixes

    • nitro: apply useHeadSafe rules to server island head

    • nitro-server: read router params from the path h3 matched

    • nitro: match server route rules case-insensitively unless routing is sensitive

    • nuxt: resolve rooted paths through the URL parser

    • nuxt: resolve empty route types in shared context

    • nitro: preserve server tsconfig with relocated build dir

    • nuxt: fix scroll offset for IDs starting with numbers

    • kit: do not exclude module directories with a dot in their name from app tsconfig

    • nuxt: detect vapor slots with rawVaporSlotKey from vue

    • nuxt: keep middleware layout when restoring deferred prerendered route

    • schema: provide default value for experimental.typescriptPlugin

    • vite: only replay compile error overlays to newly loaded pages

    • nuxt: re-export AnyFetchPath for emitted server route types

    • vite: warm up the dev ssr entry from a nitro plugin

    • nitro: avoid unused h3 imports in nuxt/server runtime

    • vite-server: scope asset url helpers to the build

    • nuxt: resolve nuxt/app to the app's runtime

    • kit: lowercase filename-derived handler method on nitro v2

    • nuxt,nitro: normalise string/array appMiddleware

    • nitro: pass response headers to render:response listeners

    • vite: resolve inlined vue to its bundler build in dev

    • nuxt: don't start a page transition with no page to leave

    • nuxt: preserve error state on aborted or cancelled navigation

    • vite,nitro: link null-byte virtual css through /@id/ in dev

    • kit: resolve module dependencies from the declaring module

    • nitro: only disable h3 + nitro presets when nitroAutoImports is off

  2. 4.6.1

    9 October 2026
    Compare changes

    v4.6.1 is the next patch release.

    Changelog

    compare changes

    Performance

    • nitro: build the portable event's web view on first access

    Fixes

    • vite: match vite 8.1+ optimizer messages for deps hint

    • nuxt: accept any baseURL when fetch response type is named

    • nitro: resolve nitropack/types declarations under nodenext

    • nuxt: allow false in setPageLayout types

    • nuxt: align Serialize object types with JSON

    • vite: don't abort dep scan on virtual imports in installed packages

    • nuxt: update publishConfig config export extension

    • kit: install the package a missing subpath belongs to

    • vite-server: use the configured outDir as the public directory for non-ssr environment

    • kit,nitro: match dev handler paths on both nitro majors

    • nuxt: preserve onServerPrefetch for useId hydration

    • vite-server: include the request in dev error reports

    • nitro: register each dev server handler once

    • nitro: pass RequestEvent to nuxt dev server handlers

    • nuxt: type the global $fetch with nuxt's TypedFetch

    • vite-server: work with deploy target plugins in dev

    • schema: ignore .wrangler directory

    • vite-server: pass the path to the error page render

    • nuxt,vite: disable dev error broadcast if BroadcastChannel throws

    • kit: align semantic version regexp with nightly version format

    • nuxt: export types reachable from async data composables

    • vite: detect enclosing string delimiter in inline style urls

    • schema: type the nuxt dev server handler variant

    • nitro: inline nuxt runtime when resolved to windows paths

  3. 4.6.0

    5 October 2026
    Alongside the release of Nuxt v4.6, today also brings a new major release of the Nuxt CLI: @nuxt/cli v4. It ships as a dependency of nuxt, so you'll get it automatically when you upgrade.

    Section of a shared release note

    Nuxt CLI v4

    Alongside the release of Nuxt v4.6, today also brings a new major release of the Nuxt CLI: @nuxt/cli v4. It ships as a dependency of nuxt, so you'll get it automatically when you upgrade.

    Most of what's new is in nuxt dev:

    • an interactive terminal UI, showing URLs, startup progress and keyboard shortcuts, with panels to dive into error logs, routes, network requests and more

    • the dev server gives you more info, such as why it reloaded or restarted, which nuxt.config keys changed, where the time went during a slow start or build, and how long each module took to set up

    • a CLI-level error channel rendered with my-bad (see below), powering things like automatically reloading when a syntax error in nuxt.config.ts is fixed

    • a lock file in .nuxt/, which lets a second nuxt dev (say, one started by an agent) take over or defer to the one you started, and powers new nuxt curl and nuxt task commands that talk to the running server

    There's also a new nuxt docs "<query>" search, and nuxt preview --takeover can replace a running preview server. And in general nuxt/cli is a lot smaller and starts a lot faster:

    v3.37v4.0
    @nuxt/cli install size13.1 MB3.5 MB-73%
    @nuxt/cli dependencies7031-56%
    nuxt dev: first paint330 ms50 ms6.6x faster
    nuxt dev: port bound338 ms104 ms3.2x faster
    nuxt dev: memory at rest (Linux)630 MB440 MB-30%

    Although this is a major version, none of the changes should be breaking for Nuxt v4 users: we require Node.js v22.21+, v24.11+ or v26+, we drop nuxt init and only support npm create nuxt@latest, and Nuxt 2 and @nuxt/bridge are no longer supported.

    👉 Check out the full Nuxt CLI v4 release notes for everything that's changed.

  4. 3.21.11

    5 August 2026
    Compare changes

    3.21.11 is a patch release.

    [!IMPORTANT] Nuxt v3 is now end-of-life. Please upgrade to Nuxt v4, or you may wish to check out our partner HeroDevs who provide never-ending support for end-of-life releases

    Changelog

    compare changes

    Fixes

    • nuxt: Serialize island payloads for components with underscores in keys

    • nitro: Dedupe island renders when prerendering

    • nitro: Reject non-object island props

    • nuxt: Re-check for preview mode after prerendered page hydration

    • nuxt: Settle asyncData status when bailing

    • kit: Clone resolved config with klona rather than klona/full

    • nuxt: Use client-side navigation for links inside islands

    • nuxt: Match route rules against decoded paths

  5. 4.5.2

    5 August 2026
    Compare changes

    4.5.2 is the next patch release.

    Changelog

    compare changes

    Performance

    • nuxt,kit: Skip rewriting unchanged generated files

    • kit,nuxt: Use lazy imports to improve parsing speed

    • vite: Skip html entry probes in bare-import resolver

    • nuxt: Reuse app and component scans for unchanged structures

    Fixes

    • vite: Resolve client manifest path from resolved config

    • nuxt: Use client-side navigation for links inside islands

    • nuxt: Generate types for route params defined with definePageMeta

    • nuxt: Serialize island payloads for components with underscores in keys

    • nitro: Dedupe island renders when prerendering

    • nuxt: Drop prefetch hints for never-hydrated chunks

    • vite: Use same asset filenames for worker builds

    • nitro: Reject non-object island props

    • nuxt: Support options api in v-for islands transform

    • nuxt: Improve page meta extraction + performance

    • nuxt: Set build outputs when restoring vue cache

    • kit: Honour nested apply and applyToEnvironment in vite wrapper

    • nuxt: Re-check for preview mode after prerendered page hydration

    • kit,nuxt,vite: Handle missed chokidar watch events

    • nuxt: Settle asyncData status when bailing

    • kit: Clone resolved config with klona rather than klona/full

    • kit: Honour nested plugins' enforce in vite wrapper

    • nuxt: Collect build cache once build outputs are final

    • vite: Resolve vite env api sourcemaps in vite-node

    • nuxt: Don't warn about missing <NuxtPage> on nav + with slot

    • kit: Prepend vite environment wrapper plugin when prepend is set

  6. 3.21.10

    27 July 2026
    It fixes server-side RCE and unauthorized component instantiation via server island props, a route rule authorization bypass, server component DoS, and dev server path disclosure. Refreshing your lockfile also pulls in @nuxt/devtools@3.3.1, which fixes a separate critical development-only RCE.

    ⚠️ This is a security release. We recommend upgrading as soon as possible with npx nuxt upgrade --dedupe.

    It fixes server-side RCE and unauthorized component instantiation via server island props, a route rule authorization bypass, server component DoS, and dev server path disclosure. Refreshing your lockfile also pulls in @nuxt/devtools@3.3.1, which fixes a separate critical development-only RCE.

    If you already upgraded for the earlier route rule advisory (CVE-2026-53721), you still need this release: one of the fixes addresses a regression introduced by that fix.

    Full details: Nuxt Security Patch Releases and GitHub Security Advisories.

    Changelog

    compare changes

    Fixes

    • nuxt: Clear hide/reset timeouts in set()

    • nuxt: Preserve trailing slash in NuxtLink href when unset

    • vite: Resolve SSR inlined CSS module class name mismatch

    • nuxt: Sync layout meta during middleware on SSR

    • nuxt: Update client URL to match SSR on fatal middleware error

    • nuxt: Watch external component directories in development

    • nuxt: Don't cross-pollute useAsyncData cache on reactive key change

    • nuxt: Return global route for useRoute in detached effect scope

    • nuxt: Ignore custom name or path when reusing an existing page in pages:extend

    • nuxt: Preserve explicit useFetch method inference

    • nuxt: Correct default export detection in plugin metadata

    • nuxt: Reload real page module on HMR of JSX render-function pages

    • vite: Ensure server sourcemap-preserver plugin actually runs

    • nuxt: Resolve @unhead/vue/* from nuxt's dependency tree

    • nuxt: Don't apply scroll behaviour after a subsequent nav

    • vite: Preserve css suffix when extracting ssr inline styles

    • nuxt: Don't exclude client entry module from style extraction

    • kit: Avoid mutating layer configs when resolving options

    • nuxt: Generate layout types even when pages module is disabled

    • nitro: Skip resource hints for stylesheets already rendered as blocking links

    • nuxt: Revalidate cached route payloads instead of using force-cache

    • nuxt: Preserve query params in cached payload extraction

    • rspack,webpack: Resolve loaders and runtime deps from nuxt dirs

  7. 4.5.1

    27 July 2026
    It fixes server-side RCE and unauthorized component instantiation via server island props, a route rule authorization bypass, server component DoS, cross-user payload disclosure on cached pages, and dev server path disclosure. Refreshing your lockfile also pulls in @nuxt/devtools@3.3.1, which fixes a separate critical development-only RCE.

    ⚠️ This is a security release. We recommend upgrading as soon as possible with npx nuxt upgrade --dedupe.

    It fixes server-side RCE and unauthorized component instantiation via server island props, a route rule authorization bypass, server component DoS, cross-user payload disclosure on cached pages, and dev server path disclosure. Refreshing your lockfile also pulls in @nuxt/devtools@3.3.1, which fixes a separate critical development-only RCE.

    If you already upgraded for the earlier route rule advisory (CVE-2026-53721), you still need this release: one of the fixes addresses a regression introduced by that fix.

    If you use the cache, swr or isr route rules, purge any CDN or edge cache after upgrading; a leaked _payload.json may already be cached upstream.

    Full details: Nuxt Security Patch Releases and GitHub Security Advisories.

    Changelog

    compare changes

    Performance

    • nitro: Replace island teleports in a single html pass

    • nuxt: Add vue.optionsApi and disable it for v5+

    • nuxt: Without pages, skip client plugins that require routing

    • nuxt: Skip payload revival plugin when ssr: false

    Fixes

    • nitro: Read rspack dev output fs lazily for server entry

    • rspack,webpack: Resolve loaders and runtime deps from nuxt dirs

    • nuxt: Return global route for useRoute in detached effect scope

    • nuxt: Ignore custom name or path when reusing an existing page in pages:extend

    • nuxt: Render client components in nested server components

    • nuxt: Preserve explicit useFetch method inference

    • nuxt: Revalidate cached route payloads instead of using force-cache

    • nuxt: Correct default export detection in plugin metadata

    • nuxt: Clear hide/reset timeouts in set()

    • kit,nuxt,rspack,schema,webpack: Add .mts file extension in resolver

    • nuxt: Preserve trailing slash in NuxtLink href when unset

    • nuxt: Don't cross-pollute useAsyncData cache on reactive key change

    • nuxt: Filter plugin dependencies by build target

    • nuxt: Reload real page module on HMR of JSX render-function pages

    • nuxt: Resolve @unhead/vue/* from nuxt's dependency tree

    • kit: Surface module load errors instead of masking as missing

    • nuxt: Type auto-imported $fetch with nitro's $Fetch

All 280 releases

Major versions

  • 4.xsince 15 July 2025 · latest 4.6.2 · 25 releases
  • 3.xsince 16 November 2022 · latest 3.21.11 · 92 releases
  • 2.xsince 21 September 2018 · latest 2.18.1 · 70 releases
  • 1.xsince 8 January 2018 · latest 1.4.5 · 12 releases
  • 0.xsince 26 October 2016 · latest 0.10.7 · 81 releases

Quality and security signals

What npm and deps.dev say about the latest release. Signals, not a verdict.

Reading npm and deps.dev…

Registry facts last checked 20 October 2026. Releases and advisories last read 20 October 2026.

Know when your own dependencies move

Inlinr tracks your coding time automatically. Switch dependency tracking on for a project and it reads that repository's manifest to show what is behind and what has been deprecated — off by default, one project at a time.

See what Inlinr doesAll packages