CVE-2026-128075: Nuxt exposes the message and data of unhandled errors thrown during server rendering
Nuxt is an open-source web development framework for Vue.js. From 3.0.0 until 4.6.4, Nuxt wraps non-HTTP errors thrown during server rendering with createError and incorrectly treats the result as an error deliberately exposed by the application. In production, the error page payload (NUXTDATA) and JSON error response can therefore disclose the original message and data, including an upstream $fetch URL, query-string secrets, response bodies, database hosts, or similar sensitive details, regardless of what a custom error.vue renders. Errors deliberately created with createError or showError, errors returned by useFetch or useAsyncData, and server/api routes are not affected because their client-visible behavior is intentional or follows a different path. This issue is fixed in version 4.6.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.6.4
Event History
Frequently Asked Questions
Which Nuxt applications are exposed?
Applications using Nuxt versions from 3.0.0 through versions before 4.6.4 are affected when a non-HTTP error is thrown during server rendering. The disclosure occurs in production error-page payloads and JSON error responses.
What must an attacker do to obtain leaked information?
An attacker needs to trigger a non-HTTP error during server rendering and inspect the resulting error page payload or JSON error response. No authentication or user interaction is required according to the supplied severity vector.
Does a custom error.vue prevent the disclosure?
No. Sensitive original error messages and data can still be present in __NUXT_DATA__ or a JSON error response regardless of what a custom error.vue renders.
What error paths are not affected?
Errors deliberately created with createError or showError, errors returned by useFetch or useAsyncData, and server/api routes are not affected by this issue. Their client-visible behavior is intentional or follows a different handling path.
What is the available remediation?
Upgrade Nuxt to version 4.6.4, which fixes the issue. If upgrading cannot happen immediately, avoid allowing non-HTTP server-rendering errors to include sensitive values such as upstream URLs, query-string secrets, response bodies, or database host details.