nuxt vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-72744Mediumnuxt: Nuxt dev server discloses project root and workspace UUID via the Chrome DevTools workspace endpointCVE-2026-71321Highnuxt: Nuxt: Unauthenticated CPU exhaustion parsing and hashing the Nuxt island endpoint body before hash validationCVE-2026-71320Highnuxt: Nuxt: Server-Side Remote Code Execution via Runtime Template Injection in Nuxt Server Island PropsCVE-2026-71318Mediumnuxt: Nuxt: Unauthorized Component Instantiation via Server Island PropsCVE-2026-71316Highnuxt: Nuxt runtime payload cache discloses another user's SSR data across users and to unauthenticated clientsCVE-2026-71315Highnuxt: Nuxt route rules silently dropped for mixed-case paths, bypassing appMiddleware auth gates (incomplete fix for CVE-2026-53721)CVE-2026-71314Highnuxt: Nuxt: Unauthenticated out-of-memory crash via unbounded v-for expansion in island renderingGHSA-M3Q2-P4FW-W38MLownuxt: Cross-site scripting via <NoScript> slot content in Nuxt's head componentsCVE-2026-53722Mediumnuxt: Nuxt: Reflected XSS in `<NuxtLink>` via unsanitised `javascript:` or `data:` URLGHSA-534H-C3CW-V3H9Mediumnuxt: Nuxt dev server vite-node IPC socket is world-connectable on LinuxCVE-2026-53721Highnuxt: Nuxt: Route-rule middleware bypass via case-sensitivity mismatch between vue-router and the routeRules matcherCVE-2026-56326Mediumnuxt: Nuxt: URL-handling weaknesses in `navigateTo` and `reloadNuxtApp`: SSR open redirect, client-side script execution via the `open` option,…GHSA-RQ7W-G337-39QQLownuxt: Nuxt: Dev server discloses project absolute path and persistent workspace UUID via `/.well-known/appspecific/com.chrome.devtools.json`CVE-2026-47200Mediumnuxt: Nuxt's route middleware is not enforced when rendering `.server.vue` pages via `/__nuxt_island/page_*`CVE-2026-46342Lownuxt: Nuxt: `__nuxt_island` endpoint does not bind responses to request props, enabling shared-cache poisoningCVE-2026-45669Mediumnuxt: Nuxt: Reflected XSS in `navigateTo()` external redirectCVE-2025-59414Lownuxt: Nuxt has Client-Side Path Traversal in Nuxt Island Payload RevivalCVE-2025-27415Highnuxt: Nuxt allows DOS via cache poisoning with payload rendering responseCVE-2024-34344Criticalnuxt: Nuxt vulnerable to remote code execution via the browser when running the test locallyCVE-2024-34343Mediumnuxt: nuxt vulnerable to Cross-site Scripting in navigateTo if used after SSRCVE-2023-3224Criticalnuxt: nuxt Code Injection vulnerability

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo