Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

45 records

Vendor: nuxt Clear all filters
TI-2026-83675 CVE-2026-120309 · GHSA-r8g5-gwcc-5r5r

Nuxt Route Parameter Confusion via getRouterParam and getRouterParams

Priority LOW 27

Nuxt from 4.6.0 before 4.6.2 contains a route parameter confusion vulnerability in getRouterParam and getRouterParams that lets attackers return a parameter value different from the one h3 matched by sending paths contai…

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00229 Published 2026-11-02 Fixed in 4.6.2 CWE-436
TI-2026-50979 CVE-2026-72744 · GHSA-7c4v-fwgw-9rf7

Nuxt before 4.5.1 Information Disclosure via Chrome DevTools

Priority LOW 30

Nuxt versions >= 4.4.7 and < 4.5.1, and >= 3.21.7 and < 3.21.10, contain an information disclosure vulnerability in the development server's Chrome DevTools workspace endpoint (GET /.well-known/appspecific/com.chrome.dev…

CVSS 4.0MEDIUM 6.9 Local No auth No interaction EPSS 0.00181 Published 2026-08-11 Fixed in 4.5.1, 3.21.10 CWE-200
TI-2026-49973 CVE-2026-71315 · GHSA-hxvh-4h3w-prp9

Incorrect authorization in nuxt

Priority MEDIUM 42

Nuxt is an open-source web development framework for Vue.js.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00466 Published 2026-08-05 Fixed in 4.5.1, 3.21.10 CWE-178
TI-2026-40666 CVE-2026-56301 · GHSA-534h-c3cw-v3h9

Nuxt - Arbitrary File Read via World-Connectable vite-node IPC Socket on Linux

Priority LOW 29

Nuxt 4.0.0 before 4.4.7 and 3.18.0 before 3.21.7, when running the development server (nuxt dev) on Linux, binds the vite-node IPC server to an abstract-namespace Unix socket without permission restrictions, allowing loc…

CVSS 4.0MEDIUM 6.8 Local Low privileges No interaction EPSS 0.00149 Published 2026-06-23 Fixed in 4.4.7, 3.21.7 CWE-276
TI-2026-40878 CVE-2026-56698 · GHSA-h345-75vh-jjwf

Nuxt - Cross-Site Scripting via navigateTo open Option

Priority LOW 24

Nuxt versions 4.0.0 before 4.4.7 and 3.x before 3.21.7 fail to validate script-capable URLs in the navigateTo open option, allowing client-side script execution.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00413 Published 2026-06-22 Fixed in 4.4.7, 3.21.7 CWE-79
TI-2026-40877 CVE-2026-56697 · GHSA-g898-grjx-8jm3

Nuxt - Open Redirect via Protocol-Relative Paths in reloadNuxtApp

Priority LOW 24

Nuxt versions 4.0.0 before 4.4.7 and 3.x before 3.21.7 accept protocol-relative paths such as //evil.com in the reloadNuxtApp function; these pass the script-protocol check but resolve to a cross-origin URL against the c…

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00337 Published 2026-06-22 Fixed in 4.4.7, 3.21.7 CWE-601
TI-2026-40691 CVE-2026-56326 · GHSA-c9cv-mq2m-ppp3

Nuxt - Server-Side Open Redirect via Path-Normalization Bypass in navigateTo

Priority LOW 24

Nuxt versions 4.0.0 before 4.4.7 and 3.x before 3.21.7 contain a server-side open redirect vulnerability in navigateTo that fails to properly validate path-normalized payloads like /..//evil.com and /.//evil.com.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00362 Published 2026-06-22 Fixed in 4.4.7, 3.21.7 CWE-601
TI-2026-40682 CVE-2026-56317 · GHSA-m3q2-p4fw-w38m

Nuxt - Cross-Site Scripting via NoScript Component Slot Content

Priority LOW 12

Nuxt before 4.4.7 (and the 3.x branch before 3.21.7) contains a cross-site scripting vulnerability in the NoScript component that writes slot content to innerHTML without escaping.

CVSS 4.0LOW 2.3 Network No auth User interaction EPSS 0.00342 Published 2026-06-20 Fixed in 4.4.7, 3.21.7 CWE-79
Load more