VulnSea

nuxt has 21 CVEs on record. Cadence is steady at roughly 10 per quarter. The busiest recent month was June 2026 with 9. The median CVSS is 7.5 (high), with 1 rated critical. None have a confirmed exploitation report. The dominant weakness classes are CWE-79 (6) and CWE-200 (4). Most affected products: nuxt (16), og_image (2), @nuxt/devtools (1).

CVEs per month

Last 12 months, by publish date

101112010203040506070809
Exploited share
0% vs 1% corpus
Median CVSS
7.5
Publish → KEV
—
Last 90 days
10 prev 11

Products

  • nuxt 16
  • og_image 2
  • @nuxt/devtools 1
  • @nuxt/ui 1
  • @nuxt/webpack-builder 1
Follow nuxt:RSS feedSave a search →Embed badge ↗
21
Total CVEs
1
Critical
0
CISA KEV
0
Exploited

Worst active — by depth score

nuxt vulnerabilities

CVEs affecting nuxt, newest first. Open any entry for full detail, references, and exploit status.

21 CVEsRSS

GHSA-4jjw-pwvw-q6w3Medium· 6.2
1mo ago

Duplicate Advisory: Nuxt dev server discloses project root and workspace UUID via the Chrome DevTools workspace endpoint

Duplicate Advisory: Nuxt dev server discloses project root and workspace UUID via the Chrome DevTools workspace endpoint

▾ Sunlitnuxt · nuxtvia GHSA
GHSA-7c4v-fwgw-9rf7Medium
1mo ago

Nuxt dev server discloses project root and workspace UUID via the Chrome DevTools workspace endpoint

Nuxt dev server discloses project root and workspace UUID via the Chrome DevTools workspace endpoint

▾ Sunlitnuxt · nuxtvia GHSA
CVE-2026-71314High· 7.5
1mo ago

Nuxt is an open-source web development framework for Vue.js

Nuxt is an open-source web development framework for Vue.js. From 3.1.0 until 3.21.10 and 4.5.1, an unauthenticated attacker can use a server island v-for prop, including vforToArray and , to trigger unbounded SSR memory allocation until…

▾ Twilightnuxt · nuxtEPSS 0.40%via NVD
CVE-2026-71315High· 8.2
1mo ago

Nuxt is an open-source web development framework for Vue.js

Nuxt is an open-source web development framework for Vue.js. From 3.21.7 until 3.21.10 and 4.5.1, mixed-case routeRules keys can fail to match case-folded lookups when router.options.sensitive is false and drop appMiddleware authorizatio…

▾ Twilightnuxt · nuxtEPSS 0.27%via NVD
CVE-2026-71316High· 7.5
1mo ago

Nuxt is an open-source web development framework for Vue.js

Nuxt is an open-source web development framework for Vue.js. From 4.4.0 until 4.5.1, runtime cache:nuxt:payload entries for /<page>/_payload.json can be returned before route middleware and page guards because import.meta.prerender is no…

▾ Twilightnuxt · nuxtEPSS 0.30%via NVD
CVE-2026-71318Medium· 4.8
1mo ago

Nuxt is an open-source web development framework for Vue.js

Nuxt is an open-source web development framework for Vue.js. From 3.1.0 until 3.21.10 and 4.5.1, an attacker can supply a top-level `as` prop to the /__nuxt_island/ endpoint and drive dynamic component resolution through <component :is>,…

▾ Sunlitnuxt · nuxtEPSS 0.21%via NVD
CVE-2026-71319Critical· 9.6
1mo ago

Nuxt is an open-source web development framework for Vue.js

Nuxt is an open-source web development framework for Vue.js. Prior to 3.3.1, Nuxt DevTools (development mode only) exposes a bidirectional RPC channel over the Vite HMR WebSocket via the nuxt:devtools:rpc plugin. On affected versions the…

▾ Midnightnuxt · @nuxt/devtoolsEPSS 0.36%via NVD
CVE-2026-71320High· 8.1
1mo ago

Nuxt is an open-source web development framework for Vue.js

Nuxt is an open-source web development framework for Vue.js. From 3.4.0 until 3.21.10 and 4.5.1, an attacker can inject a template key through /__nuxt_island/ props into a dynamic component when `vue.runtimeCompiler: true` is enabled, ca…

▾ Twilightnuxt · nuxtEPSS 0.44%via NVD
CVE-2026-71321High· 7.5
1mo ago

Nuxt is an open-source web development framework for Vue.js

Nuxt is an open-source web development framework for Vue.js. From 3.1.0 until 3.21.10 and 4.5.1, the internal island renderer endpoint `/__nuxt_island/...` decodes and hashes attacker-controlled JSON body input with destr and ohash befor…

▾ Twilightnuxt · nuxtEPSS 0.42%via NVD
GHSA-gj2h-2fpw-fhv9Medium
2mo ago

@nuxt/ui: UAuthForm / UForm SSR markup omits `method`, leaking credentials via GET if submitted before hydration

@nuxt/ui: UAuthForm / UForm SSR markup omits `method`, leaking credentials via GET if submitted before hydration

▾ Sunlitnuxt · @nuxt/uivia GHSA
GHSA-xppm-jmw6-fhmfLow
3mo ago

Duplicate Advisory: Cross-site scripting via <NoScript> slot content in Nuxt's head components

Duplicate Advisory: Cross-site scripting via <NoScript> slot content in Nuxt's head components

▾ Sunlitnuxt · nuxtvia GHSA
CVE-2026-56317Low
3mo ago

Cross-site scripting via <NoScript> slot content in Nuxt's head components

Cross-site scripting via <NoScript> slot content in Nuxt's head components

▾ Sunlitnuxt · nuxtEPSS 0.34%via GHSA
CVE-2026-56326Medium· 6.1
3mo ago

Nuxt: URL-handling weaknesses in `navigateTo` and `reloadNuxtApp`: SSR open redirect, client-side script execution via the `open` option, and protocol-relative bypass in `reloadNuxtApp`

Nuxt: URL-handling weaknesses in `navigateTo` and `reloadNuxtApp`: SSR open redirect, client-side script execution via the `open` option, and protocol-relative bypass in `reloadNuxtApp`

▾ Sunlitnuxt · nuxtEPSS 0.36%via GHSA
CVE-2026-53721High
3mo ago

Nuxt: Route-rule middleware bypass via case-sensitivity mismatch between vue-router and the routeRules matcher

Nuxt: Route-rule middleware bypass via case-sensitivity mismatch between vue-router and the routeRules matcher

▾ Twilightnuxt · nuxtEPSS 0.40%via GHSA
GHSA-534h-c3cw-v3h9Medium· 5.5
3mo ago

Nuxt dev server vite-node IPC socket is world-connectable on Linux

Nuxt dev server vite-node IPC socket is world-connectable on Linux

▾ Sunlitnuxt · nuxtvia GHSA
CVE-2026-53722Medium
3mo ago

Nuxt: Reflected XSS in `<NuxtLink>` via unsanitised `javascript:` or `data:` URL

Nuxt: Reflected XSS in `<NuxtLink>` via unsanitised `javascript:` or `data:` URL

▾ Sunlitnuxt · nuxtEPSS 0.20%via GHSA
GHSA-m3q2-p4fw-w38mLow
3mo ago

Cross-site scripting via <NoScript> slot content in Nuxt's head components

Cross-site scripting via <NoScript> slot content in Nuxt's head components

▾ Sunlitnuxt · nuxtvia GHSA
CVE-2026-49993Medium
3mo ago

@nuxt/webpack-builder and @nuxt/rspack-builder dev server same-origin check bypassed when Sec-Fetch-Site, Origin, and Referer are all absent (incomplete fix for GHSA-6m52-m754-pw2g)

@nuxt/webpack-builder and @nuxt/rspack-builder dev server same-origin check bypassed when Sec-Fetch-Site, Origin, and Referer are all absent (incomplete fix for GHSA-6m52-m754-pw2g)

▾ Sunlitnuxt · @nuxt/webpack-builderEPSS 0.28%via GHSA
GHSA-rq7w-g337-39qqLow
3mo ago

Nuxt: Dev server discloses project absolute path and persistent workspace UUID via `/.well-known/appspecific/com.chrome.devtools.json`

Nuxt: Dev server discloses project absolute path and persistent workspace UUID via `/.well-known/appspecific/com.chrome.devtools.json`

▾ Sunlitnuxt · nuxtvia GHSA
CVE-2026-34405Medium· 6.1
5mo ago

Nuxt OG Image generates OG Images with Vue templates in Nuxt

Nuxt OG Image generates OG Images with Vue templates in Nuxt. Prior to version 6.2.5, the image‑generation component by the URI: /_og/d/ (and, in older versions, /og-image/) contains a vulnerability that allows injection of arbitrary att…

▾ Sunlitnuxt · og_imageEPSS 0.22%via NVD
CVE-2026-34404High· 7.5
5mo ago

Nuxt OG Image generates OG Images with Vue templates in Nuxt

Nuxt OG Image generates OG Images with Vue templates in Nuxt. Prior to version 6.2.5, the image‑generation component by the URI: /_og/d/ (and, in older versions, /og-image/) contains a Denial of Service (DoS) vulnerability. The issue ari…

▾ Twilightnuxt · og_imageEPSS 0.32%via NVD
nuxt vulnerabilities (CVEs) · VulnSea