CVE-2026-72744 | Medium | 6.2 | 2026-08-11 | Nuxt versions >= 4.4.7 and < 4.5.1, and >= 3.21.7 and < 3.21.10, contain an information disclosure vulnerability in the development server's Chrome DevTools wo… |
CVE-2026-71321 | High | 7.5 | 2026-08-05 | Nuxt is an open-source web development framework for Vue.js. From 3.1.0 until 3.21.10 and 4.5.1, the internal island renderer endpoint `/__nuxt_island/...` dec… |
CVE-2026-71320 | High | 8.1 | 2026-08-05 | Nuxt is an open-source web development framework for Vue.js. From 3.4.0 until 3.21.10 and 4.5.1, an attacker can inject a template key through /__nuxt_island/… |
CVE-2026-71319 | Critical | 9.6 | 2026-08-05 | Nuxt is an open-source web development framework for Vue.js. Prior to 3.3.1, Nuxt DevTools (development mode only) exposes a bidirectional RPC channel over the… |
CVE-2026-71318 | Medium | 4.8 | 2026-08-05 | Nuxt is an open-source web development framework for Vue.js. From 3.1.0 until 3.21.10 and 4.5.1, an attacker can supply a top-level `as` prop to the /__nuxt_is… |
CVE-2026-71316 | High | 7.5 | 2026-08-05 | Nuxt is an open-source web development framework for Vue.js. From 4.4.0 until 4.5.1, runtime cache:nuxt:payload entries for /<page>/_payload.json can be return… |
CVE-2026-71315 | High | 8.2 | 2026-08-05 | Nuxt is an open-source web development framework for Vue.js. From 3.21.7 until 3.21.10 and 4.5.1, mixed-case routeRules keys can fail to match case-folded look… |
CVE-2026-71314 | High | 7.5 | 2026-08-05 | Nuxt is an open-source web development framework for Vue.js. From 3.1.0 until 3.21.10 and 4.5.1, an unauthenticated attacker can use a server island v-for prop… |
CVE-2026-56301 | Medium | 5.5 | 2026-06-23 | Nuxt 4.0.0 before 4.4.7 and 3.18.0 before 3.21.7, when running the development server (nuxt dev) on Linux, binds the vite-node IPC server to an abstract-namesp… |
CVE-2026-56698 | Medium | 6.1 | 2026-06-22 | Nuxt versions 4.0.0 before 4.4.7 and 3.x before 3.21.7 fail to validate script-capable URLs in the navigateTo open option, allowing client-side script executio… |
CVE-2026-56697 | Medium | 6.1 | 2026-06-22 | Nuxt versions 4.0.0 before 4.4.7 and 3.x before 3.21.7 accept protocol-relative paths such as //evil.com in the reloadNuxtApp function; these pass the script-p… |
CVE-2026-56326 | Medium | 6.1 | 2026-06-22 | Nuxt versions 4.0.0 before 4.4.7 and 3.x before 3.21.7 contain a server-side open redirect vulnerability in navigateTo that fails to properly validate path-nor… |
CVE-2026-56317 | Medium | 6.1 | 2026-06-20 | Nuxt before 4.4.7 (and the 3.x branch before 3.21.7) contains a cross-site scripting vulnerability in the NoScript component that writes slot content to innerH… |
CVE-2026-53722 | Medium | 5.4 | 2026-06-12 | Nuxt is an open-source web development framework for Vue.js. Prior to versions 3.21.7 and 4.4.7, <NuxtLink> did not validate the URL scheme of values bound to… |
CVE-2026-53721 | High | 8.2 | 2026-06-12 | Nuxt is an open-source web development framework for Vue.js. From versions 3.11.0 to before 3.21.7 and 4.0.0 to before 4.4.7, there is a route-rule middleware… |
CVE-2026-49993 | Medium | 5.7 | 2026-06-12 | Nuxt is an open-source web development framework for Vue.js. In @nuxt/rspack-builder and @nuxt/webpack-builder from versions 3.15.4 to before 3.21.7 and 4.0.0… |
CVE-2026-47200 | Medium | 5.3 | 2026-06-12 | Nuxt is an open-source web development framework for Vue.js. In Nuxt versions 3.11.0 to before 3.21.6 and 4.0.0-alpha.1 to before 4.4.6 and @nuxt/nitro-server… |
CVE-2026-46342 | Medium | 5.4 | 2026-06-12 | Nuxt is an open-source web development framework for Vue.js. In Nuxt versions 3.1.0 to before 3.21.6 and 4.0.0-alpha.1 to before 4.4.6 and @nuxt/nitro-server v… |
CVE-2026-45670 | Medium | 5.4 | 2026-06-12 | Nuxt is an open-source web development framework for Vue.js. In @nuxt/rspack-builder and @nuxt/webpack-builder versions 3.15.4 to before 3.21.6, and 4.0.0-alph… |
CVE-2026-45669 | Medium | 5.4 | 2026-06-12 | Nuxt is an open-source web development framework for Vue.js. From versions 3.4.3 to before 3.21.6 and 4.0.0-alpha.1 to before 4.4.6, navigateTo() with external… |
CVE-2026-34405 | Medium | 6.1 | 2026-03-31 | Nuxt OG Image generates OG Images with Vue templates in Nuxt. Prior to version 6.2.5, the image‑generation component by the URI: /_og/d/ (and, in older version… |
CVE-2026-34404 | High | 7.5 | 2026-03-31 | Nuxt OG Image generates OG Images with Vue templates in Nuxt. Prior to version 6.2.5, the image‑generation component by the URI: /_og/d/ (and, in older version… |
CVE-2025-52662 | Medium | 6.9 | 2025-11-07 | A vulnerability in Nuxt DevTools has been fixed in version **2.6.4***. This issue may have allowed Nuxt auth token extraction via XSS under certain configurati… |
CVE-2025-59414 | Low | 3.1 | 2025-09-17 | Nuxt is an open-source web development framework for Vue.js. Prior to 3.19.0 and 4.1.0, A client-side path traversal vulnerability in Nuxt's Island payload rev… |
CVE-2025-27415 | High | 7.5 | 2025-03-19 | Nuxt is an open-source web development framework for Vue.js. Prior to 3.16.0, by sending a crafted HTTP request to a server behind an CDN, it is possible in so… |
CVE-2025-24361 | Medium | 5.3 | 2025-01-25 | Nuxt is an open-source web development framework for Vue.js. Source code may be stolen during dev when using version 3.0.0 through 3.15.12 of the webpack build… |
CVE-2025-24360 | Medium | 5.3 | 2025-01-25 | Nuxt is an open-source web development framework for Vue.js. Starting in version 3.8.1 and prior to version 3.15.3, Nuxt allows any websites to send any reques… |
CVE-2024-42352 | High | 8.6 | 2024-08-05 | Nuxt is a free and open-source framework to create full-stack web applications and websites with Vue.js. `nuxt/icon` provides an API to allow client side icon… |
CVE-2024-34344 | High | 8.8 | 2024-08-05 | Nuxt is a free and open-source framework to create full-stack web applications and websites with Vue.js. Due to the insufficient validation of the `path` param… |
CVE-2024-34343 | Medium | 6.3 | 2024-08-05 | Nuxt is a free and open-source framework to create full-stack web applications and websites with Vue.js. The `navigateTo` function attempts to blockthe `javasc… |
CVE-2024-23657 | High | 8.8 | 2024-08-05 | Nuxt is a free and open-source framework to create full-stack web applications and websites with Vue.js. Nuxt Devtools is missing authentication on the `getTex… |
CVE-2023-3224 | Critical | 9.8 | 2023-06-13 | Code Injection in GitHub repository nuxt/nuxt prior to 3.5.3. |
CVE-2023-0878 | Medium | 6.1 | 2023-02-17 | Cross-site Scripting (XSS) - Generic in GitHub repository nuxt/framework prior to 3.2.1. |
CVE-2022-4414 | Medium | 6.1 | 2022-12-12 | Cross-site Scripting (XSS) - DOM in GitHub repository nuxt/framework prior to v3.0.0-rc.13. |
CVE-2022-4413 | Medium | 6.1 | 2022-12-12 | Cross-site Scripting (XSS) - Reflected in GitHub repository nuxt/framework prior to v3.0.0-rc.13. |