| Critical | Nuxt vulnerable to remote code execution via the browser when running the test locallyGHSA-v784-fjjh-f8r4 · 5 Aug 2024 | >= 3.4.0, < 3.12.4 | 3.12.4 |
| Critical | nuxt Code Injection vulnerabilityGHSA-gc34-5v43-h7v8 · 13 Jun 2023 | >= 3.4.0, < 3.4.3 | 3.4.3 |
| High | Nuxt: Unauthenticated CPU exhaustion parsing and hashing the Nuxt island endpoint body before hash validationGHSA-9pgf-384g-p7mv · 5 Aug 2026 | >= 4.0.0, < 4.5.1 · >= 3.1.0, < 3.21.10 | 4.5.1 |
| High | Nuxt: Server-Side Remote Code Execution via Runtime Template Injection in Nuxt Server Island PropsGHSA-9473-5f9j-94wq · 5 Aug 2026 | >= 4.0.0, < 4.5.1 · >= 3.4.0, < 3.21.10 | 4.5.1 |
| High | Nuxt runtime payload cache discloses another user's SSR data across users and to unauthenticated clientsGHSA-wm8w-6qjm-cv43 · 5 Aug 2026 | >= 4.4.0, < 4.5.1 | 4.5.1 |
| High | Nuxt route rules silently dropped for mixed-case paths, bypassing appMiddleware auth gates (incomplete fix for CVE-2026-53721)GHSA-hxvh-4h3w-prp9 · 5 Aug 2026 | >= 4.4.7, < 4.5.1 · >= 3.21.7, < 3.21.10 | 4.5.1 |
| High | Nuxt: Unauthenticated out-of-memory crash via unbounded v-for expansion in island renderingGHSA-hxcr-hm88-mpq6 · 5 Aug 2026 | >= 4.0.0, < 4.5.1 · >= 3.1.0, < 3.21.10 | 4.5.1 |
| High | Nuxt: Route-rule middleware bypass via case-sensitivity mismatch between vue-router and the routeRules matcherGHSA-mm7m-92g8-7m47 · 16 Jun 2026 | >= 4.0.0, < 4.4.7 · >= 3.11.0, < 3.21.7 | 4.4.7 |
| High | Nuxt allows DOS via cache poisoning with payload rendering responseGHSA-jvhm-gjrh-3h93 · 19 Mar 2025 | >= 3.0.0, < 3.16.0 | 3.16.0 |
| Moderate | Nuxt dev server discloses project root and workspace UUID via the Chrome DevTools workspace endpointGHSA-7c4v-fwgw-9rf7 · 7 Aug 2026 | >= 4.4.7, < 4.5.1 · >= 3.21.7, < 3.21.10 | 4.5.1 |
| Moderate | Nuxt: Unauthorized Component Instantiation via Server Island PropsGHSA-48hr-524c-v5w3 · 5 Aug 2026 | >= 4.0.0, < 4.5.1 · >= 3.1.0, < 3.21.10 | 4.5.1 |
| Moderate | Nuxt: Reflected XSS in `<NuxtLink>` via unsanitised `javascript:` or `data:` URLGHSA-934w-87qh-qr26 · 16 Jun 2026 | >= 4.0.0, < 4.4.7 · >= 3.0.0, < 3.21.7 | 4.4.7 |
| Moderate | Nuxt dev server vite-node IPC socket is world-connectable on LinuxGHSA-534h-c3cw-v3h9 · 16 Jun 2026 | >= 4.0.0, < 4.4.7 · >= 3.18.0, < 3.21.7 | 4.4.7 |
| Moderate | Nuxt: URL-handling weaknesses in `navigateTo` and `reloadNuxtApp`: SSR open redirect, client-side script execution via the `open` option, and protocol-relative bypass in `reloadNuxtApp`GHSA-c9cv-mq2m-ppp3 · 16 Jun 2026 | >= 4.0.0, < 4.4.7 · >= 3.5.0, < 3.21.7 | 4.4.7 |
| Moderate | Nuxt's route middleware is not enforced when rendering `.server.vue` pages via `/__nuxt_island/page_*`GHSA-hg3f-28rg-4jxj · 29 May 2026 | >= 3.11.0, < 3.21.6 · >= 4.0.0-alpha.1, < 4.4.6 | 4.4.6 |
| Moderate | Nuxt: Reflected XSS in `navigateTo()` external redirectGHSA-fx6j-w5w5-h468 · 19 May 2026 | >= 3.4.3, < 3.21.6 · >= 4.0.0-alpha.1, < 4.4.6 | 4.4.6 |
| Moderate | nuxt vulnerable to Cross-site Scripting in navigateTo if used after SSRGHSA-vf6r-87q4-2vjf · 5 Aug 2024 | < 3.12.4 | 3.12.4 |
| Low | Cross-site scripting via <NoScript> slot content in Nuxt's head componentsGHSA-m3q2-p4fw-w38m · 16 Jun 2026 | >= 4.0.0, < 4.4.7 · < 3.21.7 | 4.4.7 |
| Low | Nuxt: Dev server discloses project absolute path and persistent workspace UUID via `/.well-known/appspecific/com.chrome.devtools.json`GHSA-rq7w-g337-39qq · 15 Jun 2026 | >= 4.0.0-alpha.1, < 4.4.7 | 4.4.7 |
| Low | Nuxt: `__nuxt_island` endpoint does not bind responses to request props, enabling shared-cache poisoningGHSA-g8wj-3cr3-6w7v · 19 May 2026 | >= 3.1.0, < 3.21.6 · >= 4.0.0-alpha.1, < 4.4.6 | 4.4.6 |
| Low | Nuxt has Client-Side Path Traversal in Nuxt Island Payload RevivalGHSA-p6jq-8vc4-79f6 · 17 Sept 2025 | >= 3.6.0, < 3.19.0 · >= 4.0.0, < 4.1.0 | 4.1.0 |