CVE Tools
Track your stack

Nuxt

24 CVEs tracked since 2024. Since Aug 2024, none of them reached CISA KEV.

Nuxt CVEs per month

Aug 2024 to Oct 2026. Point at a month, or focus the strip and use the arrow keys.
Nuxt CVEs per month, with the share now in CISA KEV
MonthCVEsIn CISA KEV
2024-0840
2024-093 or fewer
2024-104 or fewer
2024-114 or fewer
2024-123 or fewer
2025-014 or fewer
2025-023 or fewer
2025-035 or fewer
2025-044 or fewer
2025-054 or fewer
2025-064 or fewer
2025-075 or fewer
2025-084 or fewer
2025-094 or fewer
2025-104 or fewer
2025-114 or fewer
2025-125 or fewer
2026-015 or fewer
2026-025 or fewer
2026-037 or fewer
2026-046 or fewer
2026-057 or fewer
2026-06120
2026-077 or fewer
2026-0880
2026-099 or fewer
2026-108 or fewer

Products

The products that kept showing up in Nuxt's monthly top three, with their CVEs summed over those months.

  1. Nuxt233 months
  2. Nuxt\/nitro-server21 month
  3. Nuxt\/rspack-builder21 month
  4. Devtools11 month
  5. Icon11 month

Latest CVEs

The 15 most recently published vulnerabilities affecting Nuxt.

  1. CVE-2026-119201Nuxt dev server exposes generated appSecret through Vite file serving4.8
  2. CVE-2026-119200Nuxt: Dot segments in the request path bypass `server/middleware` path checks and server route rules on page routes6.5
  3. CVE-2026-119199Nuxt dev server exposes private runtime config through the Nitro dev bundle5.9
  4. CVE-2026-119198Nuxt dev server arbitrary file read through client error reports5.9
  5. CVE-2026-114133Nuxt server islands render `useHeadSafe` input without sanitisation5.4
  6. CVE-2026-114132Nuxt: Server-side route rules (`redirect`, `headers`, `proxy`, `ssr`) are skipped for case-variant paths when routing is case-insensitive—
  7. CVE-2026-114131Nuxt: Route rules are matched against the raw request path, so a percent-encoded segment can bypass `appMiddleware` on dynamic and catch-all routes6.5
  8. CVE-2026-114130Nuxt: Incomplete fix for GHSA-934w-87qh-qr26: a `javascript:` URL prefixed with an ASCII control character executes from `<NuxtLink>` when `pages` is disabled—
  9. CVE-2026-72744Nuxt before 4.5.1 Information Disclosure via Chrome DevTools6.2
  10. CVE-2026-71321Nuxt: Unauthenticated CPU exhaustion parsing and hashing the Nuxt island endpoint body before hash validation7.5
  11. CVE-2026-71320Nuxt: Server-Side Remote Code Execution via Runtime Template Injection in Nuxt Server Island Props8.1
  12. CVE-2026-71319Nuxt.js Unauthenticated WebSocket RPC Call Leading to Remote Code Execution9.6
  13. CVE-2026-71318Nuxt: Unauthorized Component Instantiation via Server Island Props4.8
  14. CVE-2026-71316Nuxt runtime payload cache discloses another user's SSR data across users and to unauthenticated clients7.5
  15. CVE-2026-71315Nuxt route rules silently dropped for mixed-case paths, bypassing appMiddleware auth gates (incomplete fix for CVE-2026-53721)8.2

The record

Peak rank
#104 in Jun 2026
Busiest month shown
Jun 2026, 12 CVEs
Months with a KEV entry
0 since Aug 2024
Monthly snapshots
3 since 2024
Nuxt's full record, month by month