p PatchFirst

PatchFirst · Vulnerabilidades recientes

Vulnerabilidades de @nuxt/nitro-server

Vulnerabilidades publicadas para @nuxt/nitro-server en los últimos 30 días: 1. Incluidas en el catálogo KEV: 0.

RSS ↗ JSON ↗
Filtrar vulnerabilidades
Borrar filtros

Vulnerabilidades: 3

  1. CVE-2026-114132

    Media · CVSS 6.3EPSS 0,31%Corrección disponible

    Nuxt: Server-side route rules (`redirect`, `headers`, `proxy`, `ssr`) are skipped for case-variant paths when routing is case-insensitive

    Nuxt is an open-source web development framework for Vue.js. Prior to 4.6.2, Nuxt resolves pages case-insensitively by default while Nitro matches server-side route-rule keys case-sensitively, allowing a request whose path differs only by letter case to render without the server rule intended for that page. The mismatch can skip redirect, headers, proxy, ssr: false, and noScripts, and can cause getRouteRules(event) and matchRouteRules to return no rule for the case variant. Applications that set router.options.sensitive: true in nuxt.config are not affected; setting sensitive only in app/router.options.ts does not establish this exclusion bec

    @nuxt/nitro-server @nuxt/nitro-serverNode.js
    • Actualiza a 4.6.2
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  2. CVE-2026-47200

    Media · CVSS 6.3EPSS 0,35%Corrección disponible

    Nuxt: Route middleware not enforced when rendering `.server.vue` pages via `/__nuxt_island/page_*`

    Nuxt is an open-source web development framework for Vue.js. In Nuxt versions 3.11.0 to before 3.21.6 and 4.0.0-alpha.1 to before 4.4.6 and @nuxt/nitro-server versions 3.20.0 to before 3.21.6 and 4.0.0-alpha.1 to before 4.4.6, when experimental.componentIslands is enabled (default in Nuxt 4), any .server.vue file under pages/ is automatically registered as a server island under the key page_<routeName> and exposed via the /__nuxt_island/:name endpoint. Until this fix, requests through that endpoint rendered the page component directly via the SSR renderer without instantiating Vue Router, which meant route middleware declared on the page (inc

    @nuxt/nitro-server @nuxt/nitro-serverNode.js
    • Actualiza a 3.21.6
    • Actualiza a 4.4.6
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  3. CVE-2026-46342

    Baja · CVSS 2.3EPSS 0,13%Corrección disponible

    Nuxt: `__nuxt_island` endpoint does not bind responses to request props, enabling shared-cache poisoning

    Nuxt is an open-source web development framework for Vue.js. In Nuxt versions 3.1.0 to before 3.21.6 and 4.0.0-alpha.1 to before 4.4.6 and @nuxt/nitro-server versions 3.20.0 to before 3.21.6 and 4.0.0-alpha.1 to before 4.4.6, the /__nuxt_island/* endpoint accepts attacker-controlled props query/body parameters and renders any island component without verifying that the URL-resident hash (<Name>_<hashId>.json) was actually issued for those inputs by <NuxtIsland>. The hash is computed and embedded client-side but never validated server-side, so the same path can return materially different responses depending on the query. This issue has been p

    @nuxt/nitro-server @nuxt/nitro-serverNode.js
    • Actualiza a 3.21.6
    • Actualiza a 4.4.6
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

Comprueba tu servidor

Compara tu pila y las versiones instaladas con las bases actuales de vulnerabilidades.

Comprueba tu servidor →