Nuxt - Server-Side Open Redirect via Path-Normalization Bypass in navigateTo
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Spoofing, Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-601 and CWE-79.
Summary
Nuxt versions 4.0.0 before 4.4.7 and 3.x before 3.21.7 contain a server-side open redirect vulnerability in navigateTo that fails to properly validate path-normalized payloads like /..//evil.com and /.//evil.com. Attackers can bypass external-host checks using path-normalization techniques to redirect users to attacker-controlled sites via the Location header or meta-refresh, enabling phishing and OAuth authorization-code theft.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| nuxt | Nuxt | 4.0.0 to before 4.4.7 | 4.4.7 | Patch available | CNA |
| nuxt | Nuxt | before 3.21.7 | 3.21.7 | Patch available | CNA |
| — | nuxt (npm) | 4.0.0 to before 4.4.7 | 4.4.7 | Patch available | GHSA-c9cv-mq2m-ppp3 |
| — | nuxt (npm) | 3.5.0 to before 3.21.7 | 3.21.7 | Patch available | GHSA-c9cv-mq2m-ppp3 |
- Nuxt Vendornuxt Affected 4.0.0 to before 4.4.7 Fixed in 4.4.7 Patch available CNA
- Nuxt Vendornuxt Affected before 3.21.7 Fixed in 3.21.7 Patch available CNA
- nuxt (npm) Vendor— Affected 4.0.0 to before 4.4.7 Fixed in 4.4.7 Patch available GHSA-c9cv-mq2m-ppp3
- nuxt (npm) Vendor— Affected 3.5.0 to before 3.21.7 Fixed in 3.21.7 Patch available GHSA-c9cv-mq2m-ppp3
Remediation
- Fix · CNA Nuxt (Nuxt) Fixed in 4.4.7
- Fix · CNA Nuxt (Nuxt) Fixed in 3.21.7
- Fix · GHSA-c9cv-mq2m-ppp3 nuxt (npm) Fixed in 4.4.7 Advisory →
- Fix · GHSA-c9cv-mq2m-ppp3 nuxt (npm) Fixed in 3.21.7 Advisory →
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Advisory ·
Nuxt — GitHub Security Advisory (GHSA-c9cv-mq2m-ppp3)
3 records Highest priority Priority LOW 3 LOW
Other records, highest priority first
- TI-2026-40878 Nuxt - Cross-Site Scripting via navigateTo open OptionPriority LOW 24
- TI-2026-40877 Nuxt - Open Redirect via Protocol-Relative Paths in reloadNuxtAppPriority LOW 24
Timeline
- 2026-10-02 Threatist record created from CVE-2026-56326
- 2026-10-03 Alias added: GHSA-c9cv-mq2m-ppp3
References
Patch 2
Advisory 4
Other 7
- https://github.com/nuxt/nuxt/pull/35115
- https://github.com/nuxt/nuxt/pull/35206
- https://github.com/nuxt/nuxt/commit/3394716d4a913cba904b028df5338f2aead50032
- https://github.com/nuxt/nuxt/commit/62fc32eddf648b00a3890141e0235d2a222b024d
- https://github.com/nuxt/nuxt/commit/6497d99dd106254abd089f6a263d7773869a343b
- https://github.com/nuxt/nuxt/commit/e447a793c47766834f7497f8412a76cd56fd8ee1
- https://github.com/nuxt/nuxt
More Nuxt vulnerabilities
- TI-2023-03020 Code Injection in nuxt/nuxt CVSS 3.1CRITICAL 9.8
- TI-2024-28339 Server-Side Request Forgery (SSRF) in nuxt-icon CVSS 3.1HIGH 8.6
- TI-2024-22685 Remote code execution via the browser when running the test locally in nuxt CVSS 3.1HIGH 8.8
- TI-2026-34788 Nuxt: Route middleware not enforced when rendering `.server.vue` pages via `/__nuxt_island/page_*` CVSS 4.0MEDIUM 6.3
- TI-2024-22684 Cross-site Scripting (XSS) in navigateTo if used after SSR in nuxt CVSS 3.1MEDIUM 6.3
- TI-2023-00833 Cross-site Scripting (XSS) - Generic in nuxt/framework CVSS 3.1MEDIUM 6.1
Sources
- CVE-2026-56326 · CVE Program
- CVE-2026-56326 · NVD
- FIRST EPSS
- GHSA-c9cv-mq2m-ppp3 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences