CVE-2026-45669: Nuxt: Reflected XSS in `navigateTo()` external redirect
Summary navigateTo() with external: true generates a server-side HTML redirect body containing a <meta http-equiv="refresh"> tag. The destination URL is only sanitized by replacing " with %22, leaving <, >, &, and ' unencoded. An attacker who can influence the URL passed to navigateTo(url, { external: true }) can break out of the content="…" attribute and inject arbitrary HTML/JavaScript that executes under the application's origin.
This is a different root cause from CVE-2024-34343 (GHSA-vf6r-87q4-2vjf), which addressed javascript: protocol bypass. The issue here is triggered by any valid URL containing >.
Impact Applications that pass user-controlled input to navigateTo(url, { external: true }) — typically via a ?next= / ?redirect= query parameter used for post-login or "return to" flows — are vulnerable to reflected cross-site scripting. The injected script runs in the context of the application's origin during the server-rendered redirect response, before the meta-refresh fires.
Details In packages/nuxt/src/app/composables/router.ts, the SSR redirect path builds an HTML response body with only " percent-encoded in the destination URL:
ts const encodedLoc = location.replace(/"/g, '%22') nuxtApp.ssrContext!['~renderResponse'] = { status: sanitizeStatusCode(options?.redirectCode || 302, 302), body: <!DOCTYPE html><html><head><meta http-equiv="refresh" content="0; url=${encodedLoc}"></head></html>, headers: { location: encodeURL(location, isExternalHost) }, }
The Location header is normalised through encodeURL() (which uses the URL constructor and correctly percent-encodes attribute-significant characters). The HTML body uses a narrower sanitiser. That mismatch is the root cause.
Proof of concept
Global middleware that forwards a query parameter to navigateTo:
ts // middleware/redirect.global.ts export default defineNuxtRouteMiddleware((to) => { const next = to.query.next as string | undefined if (next) { return navigateTo(next, { external: true }) } })
Request:
GET /?next=https://evil.example/x><img src=x onerror=alert(document.domain)>
Response body:
html <!DOCTYPE html><html><head><meta http-equiv="refresh" content="0; url=https://evil.example/x><img src=x onerror=alert(document.domain)>"></head></html>
The > after evil.example/x terminates the content="…" attribute, and the <img onerror> tag executes JavaScript in the application's origin before any redirect occurs.
Patches Fixed in nuxt@4.4.6 and nuxt@3.21.6 by #35052. The fix percent-encodes the full set of HTML-attribute-significant characters (&, ", ', <, >) before interpolating the URL into the meta-refresh body
Workarounds If you can't upgrade immediately, validate user-controlled URLs before passing them to navigateTo(url, { external: true }). At minimum, normalise through new URL(input).toString() and reject inputs containing < or > (a normalised URL with these characters is malformed and safe to refuse).
Other sources
Nuxt is an open-source web development framework for Vue.js. From versions 3.4.3 to before 3.21.6 and 4.0.0-alpha.1 to before 4.4.6, navigateTo() with external: true generates a server-side HTML redirect body containing a <meta http-equiv="refresh"> tag. The destination URL is only sanitized by replacing " with %22, leaving <, >, &, and ' unencoded. An attacker who can influence the URL passed to navigateTo(url, { external: true }) can break out of the content="…" attribute and inject arbitrary HTML/JavaScript that executes under the application's origin. This issue has been patched in versions 3.21.6 and 4.4.6.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/nuxtto a version that resolves this vulnerability.Fixed in 4.4.6 - Upgrade
Upgrade
npm/nuxtto a version that resolves this vulnerability.Fixed in 3.21.6 - Configuration
Before calling navigateTo(url, { external: true }), validate and normalise the user-controlled URL. At minimum, run new URL(input).toString() and refuse inputs that contain '<' or '>' (or otherwise fail URL construction). Do not interpolate unvalidated input into the meta-refresh body.
Application code (navigateTo external redirects) validate_external_redirect_url = normalize via new URL(input).toString() and reject inputs containing '<' or '>'
Event History
Frequently Asked Questions
What is the severity of CVE-2026-45669?
CVE-2026-45669 has a risk rating of 71, indicating a significant security concern.
What are the potential impacts of CVE-2026-45669?
CVE-2026-45669 allows an attacker to inject malicious HTML via the URL, potentially leading to cross-site scripting (XSS) attacks.
How do I fix CVE-2026-45669?
To fix CVE-2026-45669, ensure that all user inputs for URL generation are properly validated and sanitized beyond simple replacements.
Which software is affected by CVE-2026-45669?
CVE-2026-45669 affects the npm/nuxt framework, particularly versions that use the vulnerable `navigateTo()` functionality.
Can CVE-2026-45669 be exploited remotely?
Yes, CVE-2026-45669 can be exploited remotely if an attacker can control the input to the `navigateTo()` function.