p PatchFirst

PatchFirst · Aktuelle Sicherheitslücken

Sicherheitslücken in @nuxt/nitro-server

In den letzten 30 Tagen veröffentlichte Sicherheitslücken für @nuxt/nitro-server: 1. Davon im KEV-Katalog: 0.

RSS ↗ JSON ↗
Sicherheitslücken filtern
Filter zurücksetzen

Sicherheitslücken: 3

  1. CVE-2026-114132

    Mittel · CVSS 6.3EPSS 0,31%Korrektur verfügbar

    Nuxt: Server-side route rules (`redirect`, `headers`, `proxy`, `ssr`) are skipped for case-variant paths when routing is case-insensitive

    Nuxt is an open-source web development framework for Vue.js. Prior to 4.6.2, Nuxt resolves pages case-insensitively by default while Nitro matches server-side route-rule keys case-sensitively, allowing a request whose path differs only by letter case to render without the server rule intended for that page. The mismatch can skip redirect, headers, proxy, ssr: false, and noScripts, and can cause getRouteRules(event) and matchRouteRules to return no rule for the case variant. Applications that set router.options.sensitive: true in nuxt.config are not affected; setting sensitive only in app/router.options.ts does not establish this exclusion bec

    @nuxt/nitro-server @nuxt/nitro-serverNode.js
    • Auf 4.6.2 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  2. CVE-2026-47200

    Mittel · CVSS 6.3EPSS 0,35%Korrektur verfügbar

    Nuxt: Route middleware not enforced when rendering `.server.vue` pages via `/__nuxt_island/page_*`

    Nuxt is an open-source web development framework for Vue.js. In Nuxt versions 3.11.0 to before 3.21.6 and 4.0.0-alpha.1 to before 4.4.6 and @nuxt/nitro-server versions 3.20.0 to before 3.21.6 and 4.0.0-alpha.1 to before 4.4.6, when experimental.componentIslands is enabled (default in Nuxt 4), any .server.vue file under pages/ is automatically registered as a server island under the key page_<routeName> and exposed via the /__nuxt_island/:name endpoint. Until this fix, requests through that endpoint rendered the page component directly via the SSR renderer without instantiating Vue Router, which meant route middleware declared on the page (inc

    @nuxt/nitro-server @nuxt/nitro-serverNode.js
    • Auf 3.21.6 aktualisieren
    • Auf 4.4.6 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  3. CVE-2026-46342

    Niedrig · CVSS 2.3EPSS 0,13%Korrektur verfügbar

    Nuxt: `__nuxt_island` endpoint does not bind responses to request props, enabling shared-cache poisoning

    Nuxt is an open-source web development framework for Vue.js. In Nuxt versions 3.1.0 to before 3.21.6 and 4.0.0-alpha.1 to before 4.4.6 and @nuxt/nitro-server versions 3.20.0 to before 3.21.6 and 4.0.0-alpha.1 to before 4.4.6, the /__nuxt_island/* endpoint accepts attacker-controlled props query/body parameters and renders any island component without verifying that the URL-resident hash (<Name>_<hashId>.json) was actually issued for those inputs by <NuxtIsland>. The hash is computed and embedded client-side but never validated server-side, so the same path can return materially different responses depending on the query. This issue has been p

    @nuxt/nitro-server @nuxt/nitro-serverNode.js
    • Auf 3.21.6 aktualisieren
    • Auf 4.4.6 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

Prüfen Sie Ihren Server

Gleichen Sie Ihren installierten Stack und seine Versionen mit den aktuellen Sicherheitsmeldungen ab.

Prüfen Sie Ihren Server →