Nuxt

This hub aggregates every CVE we track for Nuxt, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 15 most recently published vulnerabilities affecting Nuxt.

• CVE-2026-71321Nuxt: Unauthenticated CPU exhaustion parsing and hashing the Nuxt island endpoint body before hash validation7.5Aug 5, 2026
• CVE-2026-71320Nuxt: Server-Side Remote Code Execution via Runtime Template Injection in Nuxt Server Island Props8.1Aug 5, 2026
• CVE-2026-71318Nuxt: Unauthorized Component Instantiation via Server Island Props4.8Aug 5, 2026
• CVE-2026-71316Nuxt runtime payload cache discloses another user's SSR data across users and to unauthenticated clients7.5Aug 5, 2026
• CVE-2026-71315Nuxt route rules silently dropped for mixed-case paths, bypassing appMiddleware auth gates (incomplete fix for CVE-2026-53721)8.2Aug 5, 2026
• CVE-2026-71314Nuxt: Unauthenticated out-of-memory crash via unbounded v-for expansion in island rendering7.5Aug 5, 2026
• CVE-2026-56301Nuxt - Arbitrary File Read via World-Connectable vite-node IPC Socket on Linux5.5Jun 23, 2026
• CVE-2026-56698Nuxt - Cross-Site Scripting via navigateTo open Option6.1Jun 22, 2026
• CVE-2026-56697Nuxt - Open Redirect via Protocol-Relative Paths in reloadNuxtApp6.1Jun 22, 2026
• CVE-2026-56326Nuxt - Server-Side Open Redirect via Path-Normalization Bypass in navigateTo6.1Jun 22, 2026
• CVE-2026-56317Nuxt - Cross-Site Scripting via NoScript Component Slot Content6.1Jun 20, 2026
• CVE-2026-53722Nuxt: Reflected XSS in `<NuxtLink>` via unsanitised `javascript:` or `data:` URL5.4Jun 12, 2026
• CVE-2026-53721Nuxt: Route-rule middleware bypass via case-sensitivity mismatch between vue-router and the routeRules matcher8.2Jun 12, 2026
• CVE-2026-47200Nuxt: Route middleware not enforced when rendering `.server.vue` pages via `/__nuxt_island/page_*`5.3Jun 12, 2026
• CVE-2026-49993@nuxt/webpack-builder and @nuxt/rspack-builder dev server same-origin check bypassed when Sec-Fetch-Site, Origin, and Referer are all absent (incomplete fix for GHSA-6m52-m754-pw2g)5.7Jun 12, 2026