[ Vendor · 4 CVEs ]
nuxt
CVEs affecting nuxt published in the last 30 days, plus any nuxt CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-114132 | 21 Oct 2026 | CVSS 6.3 | Nuxt: Server-side route rules (`redirect`, `headers`, `proxy`, `ssr`) are skipped for case-variant paths when routing is case-insensitiveNuxt is an open-source web development framework for Vue.js. Prior to 4.6.2, Nuxt resolves pages case-insensitively by default while Nitro matches… | Fix |
| CVE-2026-114133 | 21 Oct 2026 | CVSS 5.4 | Nuxt server islands render `useHeadSafe` input without sanitisationNuxt is an open-source web development framework for Vue.js. From 3.13.0 until 4.6.2, the server-island renderer serializes raw useHeadSafe entry… | Fix |
| CVE-2026-114130 | 21 Oct 2026 | CVSS 2.3 | Nuxt: Incomplete fix for GHSA-934w-87qh-qr26: a `javascript:` URL prefixed with an ASCII control character executes from `<NuxtLink>` when `pages` is disabledNuxt is an open-source web development framework for Vue.js. Prior to 4.6.0, an incomplete fix for CVE-2026-53722 allows an application with pages… | Fix |
| CVE-2026-114131 | 21 Oct 2026 | CVSS 6.5 | Nuxt: Route rules are matched against the raw request path, so a percent-encoded segment can bypass `appMiddleware` on dynamic and catch-all routesNuxt is an open-source web development framework for Vue.js. From 3.11.0 until 3.21.4 and 4.4.4, Nuxt compares route-rule keys with the raw request… | Fix |