{"kind": "product", "path": "vulns/npm/nuxt", "name": "nuxt", "product": "nuxt", "ecosystem": "npm", "items": [{"id": "CVE-2026-114133", "noindex": false, "published": "2026-10-21T17:52:09.381Z", "modified": "2026-10-21T17:53:26.503Z", "cvss": 5.4, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "severity": "medium", "epss": 0.0022, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-114133", "title": "Nuxt server islands render `useHeadSafe` input without sanitisation", "description": "Nuxt is an open-source web development framework for Vue.js. From 3.13.0 until 4.6.2, the server-island renderer serializes raw useHeadSafe entry input into the island response without preserving the safe-input marker, and NuxtIsland later inserts that input into the page head as an ordinary entry. An application that passes attacker-controlled data to useHeadSafe in a .server.vue component or page, or in a component rendered through NuxtIsland, can therefore render values normally removed by the allowlist, including event-handler attributes or executable script content, resulting in stored cross-site scripting in the application origin. This", "references": ["https://github.com/nuxt/nuxt/security/advisories/GHSA-xfq5-w38q-pc2x", "https://github.com/nuxt/nuxt/commit/493565e99451a0f52330b1f6b979254a4a39e5d0", "https://github.com/nuxt/nuxt/releases/tag/v4.6.2"], "fixes": ["4.6.2"], "products": [{"name": "nuxt", "path": "vulns/npm/nuxt", "ecosystem": "npm"}]}, {"id": "CVE-2026-114132", "noindex": false, "published": "2026-10-21T17:50:11.250Z", "modified": "2026-10-23T15:10:37.684Z", "cvss": 6.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00424, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-114132", "title": "Nuxt: Server-side route rules (`redirect`, `headers`, `proxy`, `ssr`) are skipped for case-variant paths when routing is case-insensitive", "description": "Nuxt is an open-source web development framework for Vue.js. Prior to 4.6.2, Nuxt resolves pages case-insensitively by default while Nitro matches server-side route-rule keys case-sensitively, allowing a request whose path differs only by letter case to render without the server rule intended for that page. The mismatch can skip redirect, headers, proxy, ssr: false, and noScripts, and can cause getRouteRules(event) and matchRouteRules to return no rule for the case variant. Applications that set router.options.sensitive: true in nuxt.config are not affected; setting sensitive only in app/router.options.ts does not establish this exclusion bec", "references": ["https://github.com/nuxt/nuxt/security/advisories/GHSA-vjh5-4x84-xrqp", "https://github.com/nuxt/nuxt/commit/f6cfee52cf9576ddc4f4ee83b486969328b358f8", "https://github.com/nuxt/nuxt/releases/tag/v4.6.2"], "fixes": ["4.6.2"], "products": [{"name": "nuxt", "path": "vulns/npm/nuxt", "ecosystem": "npm"}, {"name": "nuxt", "path": "vulns/npm/nuxt", "ecosystem": "npm"}]}, {"id": "CVE-2026-114131", "noindex": false, "published": "2026-10-21T17:41:24.016Z", "modified": "2026-10-21T17:41:24.016Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "severity": "medium", "epss": 0.00363, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-114131", "title": "Nuxt: Route rules are matched against the raw request path, so a percent-encoded segment can bypass `appMiddleware` on dynamic and catch-all routes", "description": "Nuxt is an open-source web development framework for Vue.js. From 3.11.0 until 3.21.4 and 4.4.4, Nuxt compares route-rule keys with the raw request path while route resolution decodes dynamic and catch-all parameters, allowing a percent-encoded segment to resolve to a protected page without matching the routeRules entry intended for that path. As a result, appMiddleware can be skipped during server rendering and an unauthenticated requester can receive the gated page and its SSR data. The same mismatch affects app-manifest rules including redirect, appLayout, ssr, prerender, and payload flags derived from cache, isr, and swr. This vulnerabili", "references": ["https://github.com/nuxt/nuxt/security/advisories/GHSA-6gq8-jgmh-3ffp", "https://github.com/nuxt/nuxt/commit/81f86ac5ee82bb1a9b887e59f3bc84624d711497", "https://github.com/nuxt/nuxt/commit/9123ed850c468a7424a868c20d0d49a5507d32e5"], "fixes": ["3.21.4", "4.4.4"], "products": [{"name": "nuxt", "path": "vulns/npm/nuxt", "ecosystem": "npm"}, {"name": "nuxt", "path": "vulns/npm/nuxt", "ecosystem": "npm"}]}, {"id": "CVE-2026-114130", "noindex": false, "published": "2026-10-21T17:37:58.400Z", "modified": "2026-10-21T17:37:58.400Z", "cvss": 2.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N", "severity": "low", "epss": 0.00406, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-114130", "title": "Nuxt: Incomplete fix for GHSA-934w-87qh-qr26: a `javascript:` URL prefixed with an ASCII control character executes from `<NuxtLink>` when `pages` is disabled", "description": "Nuxt is an open-source web development framework for Vue.js. Prior to 4.6.0, an incomplete fix for CVE-2026-53722 allows an application with pages disabled to render a script-capable URL through NuxtLink when attacker-controlled input bound to to is prefixed with an ASCII C0 control character. The no-pages router classifies the value as an internal route before the earlier protocol check and passes it to the rendered anchor href; browsers remove the leading control character and interpret the remaining javascript: URL. The default anchor and NuxtLink custom output are affected, the unsafe href is present in server-rendered HTML, and a victim ", "references": ["https://github.com/nuxt/nuxt/security/advisories/GHSA-jjm6-p2m9-9w4x", "https://github.com/nuxt/nuxt/pull/36459", "https://github.com/nuxt/nuxt/commit/355ed9565127ff9b1453deb7160059ed55b3cb85"], "fixes": ["4.6.0"], "products": [{"name": "nuxt", "path": "vulns/npm/nuxt", "ecosystem": "npm"}]}, {"id": "CVE-2026-72744", "noindex": false, "published": "2026-08-11T12:16:58.926Z", "modified": "2026-08-11T17:50:47.713Z", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00181, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-72744", "title": "Nuxt before 4.5.1 Information Disclosure via Chrome DevTools", "description": "Nuxt versions >= 4.4.7 and < 4.5.1, and >= 3.21.7 and < 3.21.10, contain an information disclosure vulnerability in the development server's Chrome DevTools workspace endpoint (GET /.well-known/appspecific/com.chrome.devtools.json). The endpoint's local-request gate (isLocalDevRequest) is header-based and trusts the attacker-supplied Host header rather than the connected peer address. When the dev server is bound to a network-reachable interface (e.g. nuxt dev --host) and experimental.chromeDevtoolsProjectSettings is enabled (the default), an unauthenticated attacker on the LAN can send a request with a spoofed Host header and no browser-spec", "references": ["https://github.com/nuxt/nuxt/security/advisories/GHSA-7c4v-fwgw-9rf7", "https://www.vulncheck.com/advisories/nuxt-before-information-disclosure-via-chrome-devtools", "https://nvd.nist.gov/vuln/detail/CVE-2026-72744"], "fixes": ["3.21.10", "4.5.1"], "products": [{"name": "nuxt", "path": "vulns/npm/nuxt", "ecosystem": "npm"}, {"name": "nuxt", "path": "vulns/npm/nuxt", "ecosystem": "npm"}]}, {"id": "CVE-2026-71321", "noindex": false, "published": "2026-08-05T21:42:48.161Z", "modified": "2026-08-06T13:44:59.314Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": 0.00742, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-71321", "title": "Nuxt: Unauthenticated CPU exhaustion parsing and hashing the Nuxt island endpoint body before hash validation", "description": "Nuxt is an open-source web development framework for Vue.js. From 3.1.0 until 3.21.10 and 4.5.1, the internal island renderer endpoint `/__nuxt_island/...` decodes and hashes attacker-controlled JSON body input with destr and ohash before validating the URL-resident hash. An unauthenticated `POST /__nuxt_island/_.json` with a large JSON body is fully read, parsed, hashed, and then rejected, which wastes CPU on Nitro single event loop and delays concurrent requests. No valid hash and no authentication are required. This issue is fixed in 3.21.10 and 4.5.1.", "references": ["https://github.com/nuxt/nuxt/security/advisories/GHSA-9pgf-384g-p7mv", "https://github.com/nuxt/nuxt/commit/4e35ae9babd94be53246e31200232d48438bb34e", "https://github.com/nuxt/nuxt/commit/668cdfdfda41849ed11c1ee5e2067a11fc103b22"], "fixes": ["3.21.10", "4.5.1"], "products": [{"name": "nuxt", "path": "vulns/npm/nuxt", "ecosystem": "npm"}, {"name": "nuxt", "path": "vulns/npm/nuxt", "ecosystem": "npm"}]}, {"id": "CVE-2026-71320", "noindex": false, "published": "2026-08-05T21:29:51.370Z", "modified": "2026-08-07T03:55:36.649Z", "cvss": 8.1, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.0071, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-71320", "title": "Nuxt: Server-Side Remote Code Execution via Runtime Template Injection in Nuxt Server Island Props", "description": "Nuxt is an open-source web development framework for Vue.js. From 3.4.0 until 3.21.10 and 4.5.1, an attacker can inject a template key through /__nuxt_island/ props into a dynamic component when `vue.runtimeCompiler: true` is enabled, causing template execution in the Nitro process. This issue is fixed in 3.21.10 and 4.5.1.", "references": ["https://github.com/nuxt/nuxt/security/advisories/GHSA-9473-5f9j-94wq", "https://github.com/nuxt/nuxt/commit/5b60017f7f1d5e9384cadf1d6c580b99d583c418", "https://github.com/nuxt/nuxt/commit/ee6c846338f4eb75801815dda86df1f494725859"], "fixes": ["3.21.10", "4.5.1"], "products": [{"name": "nuxt", "path": "vulns/npm/nuxt", "ecosystem": "npm"}, {"name": "nuxt", "path": "vulns/npm/nuxt", "ecosystem": "npm"}]}, {"id": "CVE-2026-71318", "noindex": false, "published": "2026-08-05T21:21:30.509Z", "modified": "2026-08-06T14:49:15.403Z", "cvss": 4.8, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", "severity": "medium", "epss": 0.00315, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-71318", "title": "Nuxt: Unauthorized Component Instantiation via Server Island Props", "description": "Nuxt is an open-source web development framework for Vue.js. From 3.1.0 until 3.21.10 and 4.5.1, an attacker can supply a top-level `as` prop to the /__nuxt_island/ endpoint and drive dynamic component resolution through <component :is>, resolveDynamicComponent, or h(). This issue is fixed in 3.21.10 and 4.5.1.", "references": ["https://github.com/nuxt/nuxt/security/advisories/GHSA-48hr-524c-v5w3", "https://github.com/nuxt/nuxt/releases/tag/v3.21.10", "https://github.com/nuxt/nuxt/releases/tag/v4.5.1"], "fixes": ["3.21.10", "4.5.1"], "products": [{"name": "nuxt", "path": "vulns/npm/nuxt", "ecosystem": "npm"}, {"name": "nuxt", "path": "vulns/npm/nuxt", "ecosystem": "npm"}]}, {"id": "CVE-2026-71316", "noindex": false, "published": "2026-08-05T21:14:31.458Z", "modified": "2026-08-06T18:44:45.748Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "severity": "high", "epss": 0.00507, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-71316", "title": "Nuxt runtime payload cache discloses another user's SSR data across users and to unauthenticated clients", "description": "Nuxt is an open-source web development framework for Vue.js. From 4.4.0 until 4.5.1, runtime cache:nuxt:payload entries for /<page>/_payload.json can be returned before route middleware and page guards because import.meta.prerender is not enforced, disclosing another user's SSR data. This issue is fixed in 4.5.1.", "references": ["https://github.com/nuxt/nuxt/security/advisories/GHSA-wm8w-6qjm-cv43", "https://github.com/nuxt/nuxt/commit/ac9b41a36b62296a117862254ee7d2b21a2a5203", "https://github.com/nuxt/nuxt/releases/tag/v4.5.1"], "fixes": ["4.5.1"], "products": [{"name": "nuxt", "path": "vulns/npm/nuxt", "ecosystem": "npm"}]}, {"id": "CVE-2026-71315", "noindex": false, "published": "2026-08-05T21:05:15.379Z", "modified": "2026-08-06T13:46:35.243Z", "cvss": 8.2, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N", "severity": "high", "epss": 0.00466, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-71315", "title": "Nuxt route rules silently dropped for mixed-case paths, bypassing appMiddleware auth gates (incomplete fix for CVE-2026-53721)", "description": "Nuxt is an open-source web development framework for Vue.js. From 3.21.7 until 3.21.10 and 4.5.1, mixed-case routeRules keys can fail to match case-folded lookups when router.options.sensitive is false and drop appMiddleware authorization gates. This is caused by an incomplete fix for CVE-2026-53721. This issue is fixed in 3.21.10 and 4.5.1.", "references": ["https://github.com/nuxt/nuxt/security/advisories/GHSA-hxvh-4h3w-prp9", "https://github.com/nuxt/nuxt/commit/619963309e082190bac4a26b05f2dd155b039b81", "https://github.com/nuxt/nuxt/commit/ad624a75ad2d215f43633f6b40be346a7194d34d"], "fixes": ["3.21.10", "4.5.1"], "products": [{"name": "nuxt", "path": "vulns/npm/nuxt", "ecosystem": "npm"}, {"name": "nuxt", "path": "vulns/npm/nuxt", "ecosystem": "npm"}]}, {"id": "CVE-2026-71314", "noindex": false, "published": "2026-08-05T20:58:50.965Z", "modified": "2026-08-06T13:33:38.810Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": 0.00908, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-71314", "title": "Nuxt: Unauthenticated out-of-memory crash via unbounded v-for expansion in island rendering", "description": "Nuxt is an open-source web development framework for Vue.js. From 3.1.0 until 3.21.10 and 4.5.1, an unauthenticated attacker can use a server island v-for prop, including vforToArray and , to trigger unbounded SSR memory allocation until MAX_VFOR_LENGTH = 100000 and crash the Nuxt process. This issue is fixed in 3.21.10 and 4.5.1.", "references": ["https://github.com/nuxt/nuxt/security/advisories/GHSA-hxcr-hm88-mpq6", "https://github.com/nuxt/nuxt/commit/4e35ae9babd94be53246e31200232d48438bb34e", "https://github.com/nuxt/nuxt/commit/668cdfdfda41849ed11c1ee5e2067a11fc103b22"], "fixes": ["3.21.10", "4.5.1"], "products": [{"name": "nuxt", "path": "vulns/npm/nuxt", "ecosystem": "npm"}, {"name": "nuxt", "path": "vulns/npm/nuxt", "ecosystem": "npm"}]}, {"id": "CVE-2026-56301", "noindex": false, "published": "2026-06-23T12:13:02.034Z", "modified": "2026-06-23T14:34:24.230Z", "cvss": 6.8, "cvss_vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00149, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-56301", "title": "Nuxt - Arbitrary File Read via World-Connectable vite-node IPC Socket on Linux", "description": "Nuxt 4.0.0 before 4.4.7 and 3.18.0 before 3.21.7, when running the development server (nuxt dev) on Linux, binds the vite-node IPC server to an abstract-namespace Unix socket without permission restrictions, allowing local users to enumerate and connect. Unprivileged co-resident users can exploit the unprotected module request handler to read arbitrary files such as .env and SSH keys through the SSR plugin pipeline. Production builds are unaffected, as the IPC server runs only in development.", "references": ["https://github.com/nuxt/nuxt/security/advisories/GHSA-534h-c3cw-v3h9", "https://github.com/nuxt/nuxt/commit/1f9f4767a8725104da9bee872bb8d35246f25ae5", "https://github.com/nuxt/nuxt/commit/c293bf9503ccb3bc9559bff4a1f592f99063c9ea"], "fixes": ["3.21.7", "4.4.7"], "products": [{"name": "nuxt", "path": "vulns/npm/nuxt", "ecosystem": "npm"}, {"name": "nuxt", "path": "vulns/npm/nuxt", "ecosystem": "npm"}]}, {"id": "CVE-2026-56326", "noindex": false, "published": "2026-06-22T21:04:50.975Z", "modified": "2026-06-23T12:12:14.611Z", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N", "severity": "medium", "epss": 0.00362, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-56326", "title": "Nuxt - Server-Side Open Redirect via Path-Normalization Bypass in navigateTo", "description": "Nuxt versions 4.0.0 before 4.4.7 and 3.x before 3.21.7 contain a server-side open redirect vulnerability in navigateTo that fails to properly validate path-normalized payloads like /..//evil.com and /.//evil.com. Attackers can bypass external-host checks using path-normalization techniques to redirect users to attacker-controlled sites via the Location header or meta-refresh, enabling phishing and OAuth authorization-code theft.", "references": ["https://github.com/nuxt/nuxt/security/advisories/GHSA-c9cv-mq2m-ppp3", "https://github.com/nuxt/nuxt/commit/2cce6fb02e621196d56df92e05594e07469b5a6d", "https://github.com/nuxt/nuxt/commit/1f2dd5e78c77576437138e97671965573c232835"], "fixes": ["3.21.7", "4.4.7"], "products": [{"name": "nuxt", "path": "vulns/npm/nuxt", "ecosystem": "npm"}, {"name": "nuxt", "path": "vulns/npm/nuxt", "ecosystem": "npm"}]}, {"id": "CVE-2026-56317", "noindex": false, "published": "2026-06-20T15:21:56.449Z", "modified": "2026-06-24T17:53:34.670Z", "cvss": 2.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N", "severity": "low", "epss": 0.00342, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-56317", "title": "Nuxt - Cross-Site Scripting via NoScript Component Slot Content", "description": "Nuxt before 4.4.7 (and the 3.x branch before 3.21.7) contains a cross-site scripting vulnerability in the NoScript component that writes slot content to innerHTML without escaping. Attackers can inject malicious scripts through untrusted data in NoScript slots, such as route.query parameters, which execute in the document context when the noscript tag is implicitly closed by script tags.", "references": ["https://github.com/nuxt/nuxt/security/advisories/GHSA-m3q2-p4fw-w38m", "https://github.com/nuxt/nuxt/commit/4b054e9d95f8daf366cb144b52782047c511a66e", "https://github.com/nuxt/nuxt/commit/7fea9fd687f1dacbfb63db5fae5839896b017a0e"], "fixes": ["3.21.7", "4.4.7"], "products": [{"name": "nuxt", "path": "vulns/npm/nuxt", "ecosystem": "npm"}, {"name": "nuxt", "path": "vulns/npm/nuxt", "ecosystem": "npm"}]}, {"id": "GHSA-rq7w-g337-39qq", "noindex": false, "published": "2026-06-15T20:56:22Z", "modified": "2026-06-15T21:00:07.676162148Z", "cvss": 2.3, "cvss_vector": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "low", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/ghsa-rq7w-g337-39qq", "title": "Nuxt: Dev server discloses project absolute path and persistent workspace UUID via `/.well-known/appspecific/com.chrome.devtools.json`", "description": "### Summary\n\nWhen running `nuxt dev`, Nuxt registers an unauthenticated route at `/.well-known/appspecific/com.chrome.devtools.json` that returns the absolute filesystem path of the project root and a per-project UUID persisted to `node_modules/.cache/nuxt/chrome-workspace.json`. The route is enabled by default via `experimental.chromeDevtoolsProjectSettings: true`.\n\nThe endpoint exists to let Chrome DevTools' Workspace integration map sources to the developer's local checkout. The handler is registered directly on `nitro.options.devHandlers` and does not pass through the CORS / origin wrapper that the rest of the dev pipeline uses, so it has", "references": ["https://github.com/nuxt/nuxt/security/advisories/GHSA-rq7w-g337-39qq", "https://github.com/nuxt/nuxt/pull/35201", "https://github.com/nuxt/nuxt/commit/55c75b78c989b8bd210837b0e5faaebbf2b87b15"], "fixes": ["4.4.7"], "products": [{"name": "nuxt", "path": "vulns/npm/nuxt", "ecosystem": "npm"}]}, {"id": "CVE-2026-53722", "noindex": false, "published": "2026-06-12T13:44:14.592Z", "modified": "2026-06-12T15:05:46.393Z", "cvss": 5.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00293, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-53722", "title": "Nuxt: Reflected XSS in `<NuxtLink>` via unsanitised `javascript:` or `data:` URL", "description": "Nuxt is an open-source web development framework for Vue.js. Prior to versions 3.21.7 and 4.4.7, <NuxtLink> did not validate the URL scheme of values bound to its to or href props before rendering them into the href attribute of the underlying <a> element. When an application binds attacker-controlled input (a query parameter, a CMS field, a user-supplied profile URL) to <NuxtLink :to> or :href, the attacker can supply a javascript: or vbscript: URL that is reflected verbatim into the rendered markup. Clicking the link executes the supplied script in the origin of the Nuxt application, resulting in reflected DOM-based cross-site scripting. A ", "references": ["https://github.com/nuxt/nuxt/security/advisories/GHSA-934w-87qh-qr26", "https://github.com/nuxt/nuxt/commit/0103ce06fbbbdfa079a7f020ef8ce00121eac4a3", "https://github.com/nuxt/nuxt/commit/53284043dc21210a25d629d1cec67d3ae557ffd0"], "fixes": ["3.21.7", "4.4.7"], "products": [{"name": "nuxt", "path": "vulns/npm/nuxt", "ecosystem": "npm"}, {"name": "nuxt", "path": "vulns/npm/nuxt", "ecosystem": "npm"}]}, {"id": "CVE-2026-53721", "noindex": false, "published": "2026-06-12T13:41:34.022Z", "modified": "2026-06-13T02:59:37.902Z", "cvss": 8.8, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00399, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-53721", "title": "Nuxt: Route-rule middleware bypass via case-sensitivity mismatch between vue-router and the routeRules matcher", "description": "Nuxt is an open-source web development framework for Vue.js. From versions 3.11.0 to before 3.21.7 and 4.0.0 to before 4.4.7, there is a route-rule middleware bypass via case-sensitivity mismatch between vue-router and the routeRules matcher. This issue has been patched in versions 3.21.7 and 4.4.7.", "references": ["https://github.com/nuxt/nuxt/security/advisories/GHSA-mm7m-92g8-7m47", "https://github.com/nuxt/nuxt/commit/07e39cd6f26e407b4192b7865bd17bc44536b9bb", "https://github.com/nuxt/nuxt/commit/3f3e3fa7b5eec8e495f4f8ce0a54813a8875a11e"], "fixes": ["3.21.7", "4.4.7"], "products": [{"name": "nuxt", "path": "vulns/npm/nuxt", "ecosystem": "npm"}, {"name": "nuxt", "path": "vulns/npm/nuxt", "ecosystem": "npm"}]}, {"id": "CVE-2026-47200", "noindex": false, "published": "2026-06-12T12:58:00.708Z", "modified": "2026-06-13T02:56:45.199Z", "cvss": 6.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.0023, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-47200", "title": "Nuxt: Route middleware not enforced when rendering `.server.vue` pages via `/__nuxt_island/page_*`", "description": "Nuxt is an open-source web development framework for Vue.js. In Nuxt versions 3.11.0 to before 3.21.6 and 4.0.0-alpha.1 to before 4.4.6 and @nuxt/nitro-server versions 3.20.0 to before 3.21.6 and 4.0.0-alpha.1 to before 4.4.6, when experimental.componentIslands is enabled (default in Nuxt 4), any .server.vue file under pages/ is automatically registered as a server island under the key page_<routeName> and exposed via the /__nuxt_island/:name endpoint. Until this fix, requests through that endpoint rendered the page component directly via the SSR renderer without instantiating Vue Router, which meant route middleware declared on the page (inc", "references": ["https://github.com/nuxt/nuxt/security/advisories/GHSA-hg3f-28rg-4jxj", "https://github.com/nuxt/nuxt/pull/35092", "https://nvd.nist.gov/vuln/detail/CVE-2026-47200"], "fixes": ["3.21.6", "4.4.6"], "products": [{"name": "nuxt", "path": "vulns/npm/nuxt", "ecosystem": "npm"}, {"name": "nuxt", "path": "vulns/npm/nuxt", "ecosystem": "npm"}]}, {"id": "CVE-2026-45669", "noindex": false, "published": "2026-06-12T12:51:42.640Z", "modified": "2026-06-12T14:07:21.725Z", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N", "severity": "medium", "epss": 0.00177, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-45669", "title": "Nuxt: Reflected XSS in `navigateTo()` external redirect", "description": "Nuxt is an open-source web development framework for Vue.js. From versions 3.4.3 to before 3.21.6 and 4.0.0-alpha.1 to before 4.4.6, navigateTo() with external: true generates a server-side HTML redirect body containing a <meta http-equiv=\"refresh\"> tag. The destination URL is only sanitized by replacing \" with %22, leaving <, >, &, and ' unencoded. An attacker who can influence the URL passed to navigateTo(url, { external: true }) can break out of the content=\"…\" attribute and inject arbitrary HTML/JavaScript that executes under the application's origin. This issue has been patched in versions 3.21.6 and 4.4.6.", "references": ["https://github.com/nuxt/nuxt/security/advisories/GHSA-fx6j-w5w5-h468", "https://github.com/nuxt/nuxt/pull/35052", "https://nvd.nist.gov/vuln/detail/CVE-2026-45669"], "fixes": ["3.21.6", "4.4.6"], "products": [{"name": "nuxt", "path": "vulns/npm/nuxt", "ecosystem": "npm"}, {"name": "nuxt", "path": "vulns/npm/nuxt", "ecosystem": "npm"}]}, {"id": "CVE-2026-46342", "noindex": false, "published": "2026-06-12T12:50:41.589Z", "modified": "2026-06-12T20:54:39.647Z", "cvss": 2.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N", "severity": "low", "epss": 0.00091, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-46342", "title": "Nuxt: `__nuxt_island` endpoint does not bind responses to request props, enabling shared-cache poisoning", "description": "Nuxt is an open-source web development framework for Vue.js. In Nuxt versions 3.1.0 to before 3.21.6 and 4.0.0-alpha.1 to before 4.4.6 and @nuxt/nitro-server versions 3.20.0 to before 3.21.6 and 4.0.0-alpha.1 to before 4.4.6, the /__nuxt_island/* endpoint accepts attacker-controlled props query/body parameters and renders any island component without verifying that the URL-resident hash (<Name>_<hashId>.json) was actually issued for those inputs by <NuxtIsland>. The hash is computed and embedded client-side but never validated server-side, so the same path can return materially different responses depending on the query. This issue has been p", "references": ["https://github.com/nuxt/nuxt/security/advisories/GHSA-g8wj-3cr3-6w7v", "https://github.com/nuxt/nuxt/pull/35077", "https://nvd.nist.gov/vuln/detail/CVE-2026-46342"], "fixes": ["3.21.6", "4.4.6"], "products": [{"name": "nuxt", "path": "vulns/npm/nuxt", "ecosystem": "npm"}, {"name": "nuxt", "path": "vulns/npm/nuxt", "ecosystem": "npm"}]}], "total": 25, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 2, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "nuxt", "path": "vulns/npm/nuxt", "ecosystem": "npm"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 4, "kev": 0}, "lastmod": "2026-10-23T15:10:37.684Z", "early_advisories": [], "license": "Vous pouvez librement utiliser la sélection de PatchFirst et nos ajouts (priorités, alertes précoces, textes, synthèses et agrégats) pour vos propres besoins, y compris les activités internes de votre entreprise. La revente, la distribution commerciale et la mise en miroir massive de cette sélection ou de ces ajouts nécessitent un accord écrit avec l’opérateur. Lors de toute utilisation ou publication de la sélection ou de nos ajouts, citez PatchFirst (https://patchfirst.dev/vulns/) avec ce lien vers la page du flux de votre région. Les enregistrements originaux des sources ouvertes restent soumis à leurs licences et conditions respectives. Ces conditions ne limitent pas vos droits sur les données originales, que vous pouvez obtenir directement auprès de ces sources.", "terms_url": "https://patchfirst.dev/fr/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "PatchFirst sélectionne, normalise et combine les enregistrements ; des synthèses et des traductions peuvent être ajoutées. Les actualités sont accompagnées d’un lien vers la source originale dans chaque entrée.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Les licences des bases d’origine varient ; voir le catalogue des sources."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Évaluations publiques gratuites ; mention de la source demandée (FIRST EPSS, évaluations produites par Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}