VulnSea

nuxt has 28 CVEs on record between 2025 and 2026. Cadence is steady at roughly 13 per quarter. The busiest recent month was June 2026 with 11. The median CVSS is 6.3 (medium), with 1 rated critical. None have a confirmed exploitation report. The dominant weakness classes are CWE-79 (9) and CWE-200 (4). Most affected products: nuxt (22), og_image (2), @nuxt/devtools (1).

CVEs per month

Last 12 months, by publish date

111201020304050607080910
Exploited share
0% vs 1% corpus
Median CVSS
6.3
Publish → KEV
—
Last 90 days
13 prev 12

Products

  • nuxt 22
  • og_image 2
  • @nuxt/devtools 1
  • @nuxt/ui 1
  • @nuxt/webpack-builder 1
  • devtools 1
Follow nuxt:RSS feedSave a search →Embed badge ↗
28
Total CVEs
1
Critical
0
CISA KEV
0
Exploited

Worst active — by depth score

nuxt vulnerabilities

CVEs affecting nuxt, newest first. Open any entry for full detail, references, and exploit status.

28 CVEsRSS

CVE-2026-114131Medium· 6.5
6d ago

Nuxt: Route rules are matched against the raw request path, so a percent-encoded segment can bypass `appMiddleware` on dynamic and catch-all routes

Nuxt: Route rules are matched against the raw request path, so a percent-encoded segment can bypass `appMiddleware` on dynamic and catch-all routes

▾ Sunlitnuxt · nuxtEPSS 0.36%via GHSA
CVE-2026-114133Medium· 5.4
6d ago

Nuxt server islands render `useHeadSafe` input without sanitisation

Nuxt server islands render `useHeadSafe` input without sanitisation

▾ Sunlitnuxt · nuxtEPSS 0.22%via GHSA
CVE-2026-114130Low· 2.3
1w ago

Nuxt: Incomplete fix for GHSA-934w-87qh-qr26: a `javascript:` URL prefixed with an ASCII control character executes from `<NuxtLink>` when `pages` is disabled

Nuxt is an open-source web development framework for Vue.js. Prior to 4.6.0, an incomplete fix for CVE-2026-53722 allows an application with pages disabled to render a script-capable URL through NuxtLink when attacker-controlled input bo…

▾ Sunlitnuxt · nuxtEPSS 0.41%via CVEORG
CVE-2026-114132Medium· 6.3
1w ago

Nuxt: Server-side route rules (`redirect`, `headers`, `proxy`, `ssr`) are skipped for case-variant paths when routing is case-insensitive

Nuxt is an open-source web development framework for Vue.js. Prior to 4.6.2, Nuxt resolves pages case-insensitively by default while Nitro matches server-side route-rule keys case-sensitively, allowing a request whose path differs only b…

▾ Sunlitnuxt · nuxtEPSS 0.42%via CVEORG
GHSA-4jjw-pwvw-q6w3Medium· 6.2
2mo ago

Duplicate Advisory: Nuxt dev server discloses project root and workspace UUID via the Chrome DevTools workspace endpoint

Duplicate Advisory: Nuxt dev server discloses project root and workspace UUID via the Chrome DevTools workspace endpoint

▾ Sunlitnuxt · nuxtvia GHSA
GHSA-7c4v-fwgw-9rf7Medium
2mo ago

Nuxt dev server discloses project root and workspace UUID via the Chrome DevTools workspace endpoint

Nuxt dev server discloses project root and workspace UUID via the Chrome DevTools workspace endpoint

▾ Sunlitnuxt · nuxtvia GHSA
CVE-2026-71314High· 7.5
2mo ago

Nuxt is an open-source web development framework for Vue.js

Nuxt is an open-source web development framework for Vue.js. From 3.1.0 until 3.21.10 and 4.5.1, an unauthenticated attacker can use a server island v-for prop, including vforToArray and , to trigger unbounded SSR memory allocation until…

▾ Twilightnuxt · nuxtEPSS 0.91%via NVD
CVE-2026-71315High· 8.2
2mo ago

Nuxt is an open-source web development framework for Vue.js

Nuxt is an open-source web development framework for Vue.js. From 3.21.7 until 3.21.10 and 4.5.1, mixed-case routeRules keys can fail to match case-folded lookups when router.options.sensitive is false and drop appMiddleware authorizatio…

▾ Twilightnuxt · nuxtEPSS 0.47%via NVD
CVE-2026-71316High· 7.5
2mo ago

Nuxt is an open-source web development framework for Vue.js

Nuxt is an open-source web development framework for Vue.js. From 4.4.0 until 4.5.1, runtime cache:nuxt:payload entries for /<page>/_payload.json can be returned before route middleware and page guards because import.meta.prerender is no…

▾ Twilightnuxt · nuxtEPSS 0.51%via NVD
CVE-2026-71318Medium· 4.8
2mo ago

Nuxt is an open-source web development framework for Vue.js

Nuxt is an open-source web development framework for Vue.js. From 3.1.0 until 3.21.10 and 4.5.1, an attacker can supply a top-level `as` prop to the /__nuxt_island/ endpoint and drive dynamic component resolution through <component :is>,…

▾ Sunlitnuxt · nuxtEPSS 0.32%via NVD
CVE-2026-71319Critical· 9.6
2mo ago

Nuxt is an open-source web development framework for Vue.js

Nuxt is an open-source web development framework for Vue.js. Prior to 3.3.1, Nuxt DevTools (development mode only) exposes a bidirectional RPC channel over the Vite HMR WebSocket via the nuxt:devtools:rpc plugin. On affected versions the…

▾ Midnightnuxt · @nuxt/devtoolsEPSS 0.63%via NVD
CVE-2026-71320High· 8.1
2mo ago

Nuxt is an open-source web development framework for Vue.js

Nuxt is an open-source web development framework for Vue.js. From 3.4.0 until 3.21.10 and 4.5.1, an attacker can inject a template key through /__nuxt_island/ props into a dynamic component when `vue.runtimeCompiler: true` is enabled, ca…

▾ Twilightnuxt · nuxtEPSS 0.71%via NVD
CVE-2026-71321High· 7.5
2mo ago

Nuxt is an open-source web development framework for Vue.js

Nuxt is an open-source web development framework for Vue.js. From 3.1.0 until 3.21.10 and 4.5.1, the internal island renderer endpoint `/__nuxt_island/...` decodes and hashes attacker-controlled JSON body input with destr and ohash befor…

▾ Twilightnuxt · nuxtEPSS 0.74%via NVD
GHSA-gj2h-2fpw-fhv9Medium
3mo ago

@nuxt/ui: UAuthForm / UForm SSR markup omits `method`, leaking credentials via GET if submitted before hydration

@nuxt/ui: UAuthForm / UForm SSR markup omits `method`, leaking credentials via GET if submitted before hydration

▾ Sunlitnuxt · @nuxt/uivia GHSA
GHSA-2x6f-57hp-86fxMedium· 5.5
4mo ago

Duplicate Advisory: Nuxt dev server vite-node IPC socket is world-connectable on Linux

Duplicate Advisory: Nuxt dev server vite-node IPC socket is world-connectable on Linux

▾ Sunlitnuxt · nuxtvia GHSA
GHSA-xppm-jmw6-fhmfLow
4mo ago

Duplicate Advisory: Cross-site scripting via <NoScript> slot content in Nuxt's head components

Duplicate Advisory: Cross-site scripting via <NoScript> slot content in Nuxt's head components

▾ Sunlitnuxt · nuxtvia GHSA
CVE-2026-56301Medium· 5.5
4mo ago

Nuxt dev server vite-node IPC socket is world-connectable on Linux

Nuxt dev server vite-node IPC socket is world-connectable on Linux

▾ Sunlitnuxt · nuxtEPSS 0.15%via GHSA
CVE-2026-56317Low
4mo ago

Cross-site scripting via <NoScript> slot content in Nuxt's head components

Cross-site scripting via <NoScript> slot content in Nuxt's head components

▾ Sunlitnuxt · nuxtEPSS 0.34%via GHSA
CVE-2026-56326Medium· 6.1
4mo ago

Nuxt: URL-handling weaknesses in `navigateTo` and `reloadNuxtApp`: SSR open redirect, client-side script execution via the `open` option, and protocol-relative bypass in `reloadNuxtApp`

Nuxt: URL-handling weaknesses in `navigateTo` and `reloadNuxtApp`: SSR open redirect, client-side script execution via the `open` option, and protocol-relative bypass in `reloadNuxtApp`

▾ Sunlitnuxt · nuxtEPSS 0.36%via GHSA
CVE-2026-53721High
4mo ago

Nuxt: Route-rule middleware bypass via case-sensitivity mismatch between vue-router and the routeRules matcher

Nuxt: Route-rule middleware bypass via case-sensitivity mismatch between vue-router and the routeRules matcher

▾ Twilightnuxt · nuxtEPSS 0.40%via GHSA
GHSA-534h-c3cw-v3h9Medium· 5.5
4mo ago

Nuxt dev server vite-node IPC socket is world-connectable on Linux

Nuxt dev server vite-node IPC socket is world-connectable on Linux

▾ Sunlitnuxt · nuxtvia GHSA
CVE-2026-53722Medium
4mo ago

Nuxt: Reflected XSS in `<NuxtLink>` via unsanitised `javascript:` or `data:` URL

Nuxt: Reflected XSS in `<NuxtLink>` via unsanitised `javascript:` or `data:` URL

▾ Sunlitnuxt · nuxtEPSS 0.29%via GHSA
GHSA-m3q2-p4fw-w38mLow
4mo ago

Cross-site scripting via <NoScript> slot content in Nuxt's head components

Cross-site scripting via <NoScript> slot content in Nuxt's head components

▾ Sunlitnuxt · nuxtvia GHSA
CVE-2026-49993Medium
4mo ago

@nuxt/webpack-builder and @nuxt/rspack-builder dev server same-origin check bypassed when Sec-Fetch-Site, Origin, and Referer are all absent (incomplete fix for GHSA-6m52-m754-pw2g)

@nuxt/webpack-builder and @nuxt/rspack-builder dev server same-origin check bypassed when Sec-Fetch-Site, Origin, and Referer are all absent (incomplete fix for GHSA-6m52-m754-pw2g)

▾ Sunlitnuxt · @nuxt/webpack-builderEPSS 0.28%via GHSA
GHSA-rq7w-g337-39qqLow
4mo ago

Nuxt: Dev server discloses project absolute path and persistent workspace UUID via `/.well-known/appspecific/com.chrome.devtools.json`

Nuxt: Dev server discloses project absolute path and persistent workspace UUID via `/.well-known/appspecific/com.chrome.devtools.json`

▾ Sunlitnuxt · nuxtvia GHSA
CVE-2026-34405Medium· 6.1
7mo ago

Nuxt OG Image generates OG Images with Vue templates in Nuxt

Nuxt OG Image generates OG Images with Vue templates in Nuxt. Prior to version 6.2.5, the image‑generation component by the URI: /_og/d/ (and, in older versions, /og-image/) contains a vulnerability that allows injection of arbitrary att…

▾ Sunlitnuxt · og_imageEPSS 0.22%via NVD
CVE-2026-34404High· 7.5
7mo ago

Nuxt OG Image generates OG Images with Vue templates in Nuxt

Nuxt OG Image generates OG Images with Vue templates in Nuxt. Prior to version 6.2.5, the image‑generation component by the URI: /_og/d/ (and, in older versions, /og-image/) contains a Denial of Service (DoS) vulnerability. The issue ari…

▾ Twilightnuxt · og_imageEPSS 0.32%via NVD
CVE-2025-52662Medium· 6.9
11mo ago

A vulnerability in Nuxt DevTools has been fixed in version **2.6.4***

A vulnerability in Nuxt DevTools has been fixed in version **2.6.4***. This issue may have allowed Nuxt auth token extraction via XSS under certain configurations. All users are encouraged to upgrade. More details: https://vercel.com/…

▾ Sunlitnuxt · devtoolsEPSS 0.25%via NVD
nuxt vulnerabilities (CVEs) · VulnSea