nuxt

Records45All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical2CVSS 9.0–10.0

CVSS high11CVSS 7.0–8.9

Exploited now

nuxt records in CISA KEV

No nuxt vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Nuxt 18 records HIGH Framework 2 records HIGH Nuxt/nitro-server 2 records HIGH Nuxt/rspack-builder 2 records MEDIUM Nuxt/webpack-builder 2 records MEDIUM Og Image 2 records HIGH Devtools 1 record LOW

Records

45 records

TI-2023-03020 CVE-2023-3224 · GHSA-gc34-5v43-h7v8

Code Injection in nuxt/nuxt

HIGH 77

Code Injection in GitHub repository nuxt/nuxt prior to 3.5.3.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.58648 Published 2023-06-13 Fixed in 3.5.3, 3.4.3 CWE-94

TI-2024-28339 CVE-2024-42352 · GHSA-cxgv-px37-4mp2

Server-Side Request Forgery (SSRF) in nuxt-icon

HIGH 76

Nuxt is a free and open-source framework to create full-stack web applications and websites with Vue.js.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00648 Published 2024-08-05 Fixed in 1.4.5 CWE-918

TI-2024-22685 CVE-2024-34344 · GHSA-v784-fjjh-f8r4

Remote code execution via the browser when running the test locally in nuxt

HIGH 73

Nuxt is a free and open-source framework to create full-stack web applications and websites with Vue.js.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00828 Published 2024-08-05 Fixed in 3.12.4 CWE-94

TI-2026-26689 CVE-2026-34404 · GHSA-c7xp-q6q8-hg76

Nuxt OG Image vulnerable to DoS via image generation

HIGH 70

Nuxt OG Image generates OG Images with Vue templates in Nuxt.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00337 Published 2026-03-31 Fixed in 6.2.5 CWE-400

TI-2022-04037 CVE-2022-4414 · GHSA-655c-fv7v-c7p7

Cross-site Scripting (XSS) - DOM in nuxt/framework

HIGH 68

Cross-site Scripting (XSS) - DOM in GitHub repository nuxt/framework prior to v3.0.0-rc.13.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00481 Published 2022-12-11 Fixed in v3.0.0-rc.13 CWE-79

TI-2022-04036 CVE-2022-4413 · GHSA-w9pr-59v3-7rgc

Cross-site Scripting (XSS) - Reflected in nuxt/framework

HIGH 68

Cross-site Scripting (XSS) - Reflected in GitHub repository nuxt/framework prior to v3.0.0-rc.13.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00544 Published 2022-12-11 Fixed in v3.0.0-rc.13 CWE-79

TI-2026-34788 CVE-2026-47200 · GHSA-hg3f-28rg-4jxj

Nuxt: Route middleware not enforced when rendering `.server.vue` pages via `/__nuxt_island/page_*`

HIGH 67

Nuxt is an open-source web development framework for Vue.js.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.0023 Published 2026-06-12 Fixed in 3.21.6, 4.4.6 CWE-284

TI-2024-22684 CVE-2024-34343 · GHSA-vf6r-87q4-2vjf

Cross-site Scripting (XSS) in navigateTo if used after SSR in nuxt

MEDIUM 61

Nuxt is a free and open-source framework to create full-stack web applications and websites with Vue.js.

CVSS 3.1MEDIUM 6.3 Network No auth User interaction EPSS 0.0044 Published 2024-08-05 Fixed in 3.12.4 CWE-79

TI-2026-36824 CVE-2026-49993 · GHSA-x6qj-4h56-5rj5

@nuxt/webpack-builder and @nuxt/rspack-builder dev server same-origin check bypassed when…

MEDIUM 60

Nuxt is an open-source web development framework for Vue.js.

CVSS 4.0MEDIUM 5.9 Adjacent network No auth User interaction EPSS 0.0028 Published 2026-06-12 Fixed in 3.21.7, 4.4.7 CWE-749

TI-2026-33412 CVE-2026-45670 · GHSA-6m52-m754-pw2g

Nuxt: Dev server exposes built source over LAN to malicious sites (incomplete fix for GHSA-4gf7-ff8x-hq99)

MEDIUM 60

Nuxt is an open-source web development framework for Vue.js.

CVSS 4.0MEDIUM 5.9 Adjacent network No auth User interaction EPSS 0.00205 Published 2026-06-12 Fixed in 3.21.6, 4.4.6 CWE-749

TI-2026-26690 CVE-2026-34405 · GHSA-mg36-wvcr-m75h

Nuxt OG Image vulnerable to reflected XSS via query parameter injection into HTML attributes

MEDIUM 60

Nuxt OG Image generates OG Images with Vue templates in Nuxt.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00224 Published 2026-03-31 Fixed in 6.2.5 CWE-79

TI-2023-00833 CVE-2023-0878 · GHSA-fcqf-hhgj-p27f

Cross-site Scripting (XSS) - Generic in nuxt/framework

MEDIUM 60

Cross-site Scripting (XSS) - Generic in GitHub repository nuxt/framework prior to 3.2.1.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00528 Published 2023-02-17 Fixed in 3.2.1 CWE-79

TI-2026-33411 CVE-2026-45669 · GHSA-fx6j-w5w5-h468

Nuxt: Reflected XSS in `navigateTo()` external redirect

MEDIUM 57

Nuxt is an open-source web development framework for Vue.js.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00177 Published 2026-06-12 Fixed in 3.21.6, 4.4.6 CWE-83

TI-2025-18104 CVE-2025-24361 · GHSA-4gf7-ff8x-hq99

Opening a malicious website while running a Nuxt dev server could allow read-only access to code

MEDIUM 57

Nuxt is an open-source web development framework for Vue.js.

CVSS 3.1MEDIUM 5.3 Network No auth User interaction EPSS 0.00342 Published 2025-01-25 Fixed in 3.15.3 CWE-749

TI-2025-18103 CVE-2025-24360 · GHSA-2452-6xj8-jh47

Opening a malicious website while running a Nuxt dev server could allow read-only access to code

MEDIUM 57

Nuxt is an open-source web development framework for Vue.js.

CVSS 3.1MEDIUM 5.3 Network No auth User interaction EPSS 0.00557 Published 2025-01-25 Fixed in 3.15.3 CWE-200

TI-2026-38741 CVE-2026-53721 · GHSA-mm7m-92g8-7m47

Nuxt: Route-rule middleware bypass via case-sensitivity mismatch between vue-router and the routeRules matcher

MEDIUM 46

Nuxt is an open-source web development framework for Vue.js.

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00399 Published 2026-06-12 Fixed in 3.21.7, 4.4.7 CWE-178

TI-2026-49977 CVE-2026-71319 · GHSA-279x-mwfv-vcqv

Nuxt.js Unauthenticated WebSocket RPC Call Leading to Remote Code Execution

MEDIUM 44

Nuxt is an open-source web development framework for Vue.js.

CVSS 3.1CRITICAL 9.6 Network No auth User interaction EPSS 0.00629 Published 2026-08-05 Fixed in 3.3.1 CWE-306

TI-2026-49973 CVE-2026-71315 · GHSA-hxvh-4h3w-prp9

Incorrect authorization in nuxt

MEDIUM 42

Nuxt is an open-source web development framework for Vue.js.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00466 Published 2026-08-05 Fixed in 4.5.1, 3.21.10 CWE-178

TI-2024-15676 CVE-2024-23657 · GHSA-rcvg-rgf7-pppv

Path Traversal: '../filedir' in Nuxt Devtools

MEDIUM 42

Nuxt is a free and open-source framework to create full-stack web applications and websites with Vue.js.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01212 Published 2024-08-05 Fixed in 1.3.9 CWE-22

TI-2026-49972 CVE-2026-71314 · GHSA-hxcr-hm88-mpq6

Nuxt: Unauthenticated out-of-memory crash via unbounded v-for expansion in island rendering

MEDIUM 41

Nuxt is an open-source web development framework for Vue.js.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00908 Published 2026-08-05 Fixed in 4.5.1, 3.21.10 CWE-1284

TI-2026-49979 CVE-2026-71321 · GHSA-9pgf-384g-p7mv

Nuxt: Unauthenticated CPU exhaustion parsing and hashing the Nuxt island endpoint body before hash validation

MEDIUM 40

Nuxt is an open-source web development framework for Vue.js.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00742 Published 2026-08-05 Fixed in 4.5.1, 3.21.10 CWE-407

TI-2026-49974 CVE-2026-71316 · GHSA-wm8w-6qjm-cv43

Nuxt runtime payload cache discloses another user's SSR data across users and to unauthenticated clients

LOW 39

Nuxt is an open-source web development framework for Vue.js.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00507 Published 2026-08-05 Fixed in 4.5.1 CWE-524

TI-2025-20250 CVE-2025-27415 · GHSA-jvhm-gjrh-3h93

Nuxt allows DOS via cache poisoning with payload rendering response

LOW 39

Nuxt is an open-source web development framework for Vue.js.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00391 Published 2025-03-19 Fixed in 3.16.0 CWE-349

TI-2026-49978 CVE-2026-71320 · GHSA-9473-5f9j-94wq

Nuxt: Server-Side Remote Code Execution via Runtime Template Injection in Nuxt Server Island Props

LOW 38

Nuxt is an open-source web development framework for Vue.js.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.0071 Published 2026-08-05 Fixed in 4.5.1, 3.21.10 CWE-74

TI-2026-82750 CVE-2026-119200 · GHSA-9v7c-q64q-vv33

Nuxt dot segments bypass server middleware and route rules on page routes

LOW 35

Nuxt is an open-source web development framework for Vue.js.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00339 Published 2026-10-29 Fixed in 4.6.3 CWE-41

Open these records in search →

Critical	2
High	11
Medium	28
Low	4
No CVSS	0