Nuxt vulnerabilities
Filtered catalog for this technology stack. Use KEV and EPSS sorting to prioritize — then open each CVE for remediation and version matching.
28 matching records
- Medium4.8Nuxt dev server exposes generated appSecret through Vite file servingCheck if you run itEPSS 0.21%Oct 27, 2026
- Low3.7Server island endpoint does not apply route rules to pagesOpen the advisoryOct 27, 2026
- Medium6.5Nuxt: Dot segments in the request path bypass path checks and server route rules on page routesCheck if you run itEPSS 0.34%Oct 27, 2026
- Medium5.9Nuxt dev server arbitrary file read through client error reportsCheck if you run itEPSS 0.29%Oct 27, 2026
- Medium5.9Nuxt dev server exposes private runtime config through the Nitro dev bundleCheck if you run itEPSS 0.35%Oct 27, 2026
- Low2.3Nuxt: Incomplete fix for GHSA-934w-87qh-qr26: a URL prefixed with an ASCII control character executes from when is disabledCheck if you run itEPSS 0.41%Oct 21, 2026
- Medium6.3Nuxt: Server-side route rules ( , , , ) are skipped for case-variant paths when routing is case-insensitiveCheck if you run itEPSS 0.42%Oct 16, 2026
- Low3.7from can return a different param from the one h3 matched when the path containsOpen the advisoryOct 16, 2026
- Medium5.4Nuxt server islands render input without sanitisationCheck if you run itEPSS 0.22%Oct 16, 2026
- Medium6.5Nuxt: Route rules are matched against the raw request path, so a percent-encoded segment can bypass on dynamic and catch-all routesCheck if you run itEPSS 0.36%Oct 16, 2026
- Medium6.9Nuxt OG Image generates OG Images with Vue templates in Nuxt.Check if you run itEPSS 0.19%Oct 15, 2026
- UnknownMalicious code in @kibt/www-nuxt-i18n (npm)Open the advisoryOct 4, 2026
- High7.5Unauthenticated out-of-memory crash via unbounded v-for expansion in Nuxt island renderingCheck if you run itEPSS 0.91%Jul 27, 2026
- High7.5Unauthenticated CPU exhaustion parsing and hashing the Nuxt island endpoint body before hash validationCheck if you run itEPSS 0.74%Jul 27, 2026
- High8.2CVE-2026-71315 is listed by Nuxt route rules silently dropped for mixed-case paths, bypassing appMiddleware auth gates (incomplete fix for CVE-2026-53721).Check if you run itEPSS 0.47%Jul 27, 2026
- LowNuxt dev server discloses project root and workspace UUID via the Chrome DevTools workspace endpointOpen the advisoryJul 27, 2026
- Critical9.6Unauthenticated Nuxt DevTools RPC allows arbitrary command execution on the developer's hostCheck if you run itEPSS 0.63%Jul 27, 2026
- High7.5Nuxt runtime payload cache discloses another user's SSR data across users and to unauthenticated clientsCheck if you run itEPSS 0.51%Jul 27, 2026
- High8.1Server-Side Remote Code Execution via Runtime Template Injection in Nuxt Server Island PropsCheck if you run itEPSS 0.71%Jul 27, 2026
- Medium4.8Unauthorized Component Instantiation via Server Island Props in NuxtCheck if you run itEPSS 0.32%Jul 27, 2026
- HighRoute-rule middleware bypass via case-sensitivity mismatch between vue-router and the routeRules matcherCheck if you run itEPSS 0.40%Jun 2, 2026
- Low3.7Nuxt OG Image generates OG Images with Vue templates in Nuxt.Check if you run itEPSS 0.17%May 14, 2026
- Medium6.1Nuxt OG Image generates OG Images with Vue templates in Nuxt.Check if you run itEPSS 0.22%Mar 31, 2026
- Medium6.9Nuxt OG Image generates OG Images with Vue templates in Nuxt.Check if you run itEPSS 0.34%Mar 31, 2026
- Medium6.9A vulnerability in Nuxt DevTools has been fixed in version **2.6.4***.Check if you run itEPSS 0.25%Nov 7, 2025