CVE-2026-56326: Nuxt - Server-Side Open Redirect via Path-Normalization Bypass in navigateTo
Nuxt versions 4.0.0 before 4.4.7 and 3.x before 3.21.7 contain a server-side open redirect vulnerability in navigateTo that fails to properly validate path-normalized payloads like /..//evil.com and /.//evil.com. Attackers can bypass external-host checks using path-normalization techniques to redirect users to attacker-controlled sites via the Location header or meta-refresh, enabling phishing and OAuth authorization-code theft.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Nuxt (navigateTo)to a version that resolves this vulnerability.Fixed in 4.4.7 - Upgrade
Upgrade
Nuxt (navigateTo)to a version that resolves this vulnerability.Fixed in 3.21.7
Event History
Frequently Asked Questions
What is the severity of CVE-2026-56326?
CVE-2026-56326 has a medium severity rating of 5.3.
How do I fix CVE-2026-56326?
To fix CVE-2026-56326, update Nuxt to version 4.4.7 or later for 4.x, and to version 3.21.7 or later for 3.x.
What impact does CVE-2026-56326 have on my Nuxt application?
CVE-2026-56326 allows attackers to exploit a server-side open redirect, potentially leading to phishing or credential theft.
Which versions of Nuxt are affected by CVE-2026-56326?
Nuxt versions 4.0.0 to 4.4.6 and 3.x to 3.21.6 are affected by CVE-2026-56326.
What mitigation strategies can be implemented for CVE-2026-56326?
In addition to updating, ensure proper input validation and implement logging to detect unusual redirect attempts.