Where
-Infinity
0

Trending

Last week
Last month
Last year

Vendor Risk Score

See how nuxt compares to other vendors in security performance

View Risk Score →

Nuxt NuxtNuxt before 4.5.1 Information Disclosure via Chrome DevTools

Risk 38
Severity
6.9
First published (updated )
CVE-2026-72744

Nuxt NuxtNuxt - Arbitrary File Read via World-Connectable vite-node IPC Socket on Linux

Risk 37
Severity
6.8
First published (updated )
CVE-2026-56301

Nuxt NuxtNuxt - Open Redirect via Protocol-Relative Paths in reloadNuxtApp

Risk 38
Severity
5.3
First published (updated )
CVE-2026-56697

Nuxt NuxtNuxt - Cross-Site Scripting via navigateTo open Option

Risk 38
Severity
5.3
First published (updated )
CVE-2026-56698

Nuxt NuxtNuxt - Server-Side Open Redirect via Path-Normalization Bypass in navigateTo

Risk 38
Severity
5.3
First published (updated )
CVE-2026-56326
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Nuxt NuxtNuxt - Cross-Site Scripting via NoScript Component Slot Content

Risk 38
Severity
2.3
First published (updated )
CVE-2026-56317

npm/nuxtNuxt: Reflected XSS in `<NuxtLink>` via unsanitised `javascript:` or `data:` URL

Risk 34
Severity
5.1
First published (updated )
CVE-2026-53722

npm/nuxtNuxt: Route-rule middleware bypass via case-sensitivity mismatch between vue-router and the routeRules matcher

Risk 57
Severity
8.8
First published (updated )
CVE-2026-53721

npm/@nuxt/webpack-builder@nuxt/webpack-builder and @nuxt/rspack-builder dev server same-origin check bypassed when Sec-Fetch-Site, Origin, and Referer are all absent (incomplete fix for GHSA-6m52-m754-pw2g)

Risk 31
Severity
5.9
First published (updated )
CVE-2026-49993

npm/nuxtNuxt: Route middleware not enforced when rendering `.server.vue` pages via `/__nuxt_island/page_*`

Risk 29
Severity
6.3
First published (updated )
CVE-2026-47200
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

npm/@nuxt/nitro-serverNuxt: `__nuxt_island` endpoint does not bind responses to request props, enabling shared-cache poisoning

Risk 34
Severity
2.3
First published (updated )
CVE-2026-46342

npm/@nuxt/webpack-builderNuxt: Dev server exposes built source over LAN to malicious sites (incomplete fix for GHSA-4gf7-ff8x-hq99)

Risk 31
Severity
5.9
First published (updated )
CVE-2026-45670

npm/nuxtNuxt: Reflected XSS in `navigateTo()` external redirect

Risk 34
Severity
5.3
First published (updated )
CVE-2026-45669

npm/nuxt-og-imageNuxt OG Image vulnerable to reflected XSS via query parameter injection into HTML attributes

Risk 38
Severity
6.1
First published (updated )
CVE-2026-34405

npm/nuxt-og-imageNuxt OG Image vulnerable to DoS via image generation

Risk 43
Severity
6.9
First published (updated )
CVE-2026-34404
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Vercel Nuxt DevToolsXSS

Risk 46
Severity
6.9
First published (updated )
CVE-2025-52662

Nuxt NuxtNuxt Client-Side Path Traversal in Nuxt Island Payload Revival

Risk 17
Severity
3.1
First published (updated )
CVE-2025-59414

Nuxt NuxtNuxt allows DOS via cache poisoning with payload rendering response

Risk 31
Severity
7.5
EPSS
0.34%
First published (updated )
CVE-2025-27415

Nuxt.jsOpening a malicious website while running a Nuxt dev server could allow read-only access to code

Risk 23
Severity
5.3
EPSS
0.04%
First published (updated )
CVE-2025-24361

npm/@nuxt/vite-builderOpening a malicious website while running a Nuxt dev server could allow read-only access to code

Risk 23
Severity
5.3
EPSS
0.04%
First published (updated )
CVE-2025-24360
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

npm/@nuxt/iconServer-Side Request Forgery (SSRF) in nuxt-icon

Risk 51
Severity
8.6
First published (updated )
CVE-2024-42352

npm/nuxtRemote code execution via the browser when running the test locally in nuxt

Risk 80
Severity
8.8
First published (updated )
CVE-2024-34344

Nuxt.jsCross-site Scripting (XSS) in navigateTo if used after SSR in nuxt

Risk 47
Severity
6.3
First published (updated )
CVE-2024-34343

npm/@nuxt/devtoolsPath Traversal: '../filedir' in Nuxt Devtools

Risk 80
Severity
8.8
First published (updated )
CVE-2024-23657

npm/nuxtCode Injection in nuxt/nuxt

Risk 89
Severity
9.8
First published (updated )
CVE-2023-3224
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Nuxt.jsCross-site Scripting (XSS) - Generic in nuxt/framework

Risk 38
Severity
6.1
First published (updated )
CVE-2023-0878

Nuxt frameworkCross-site Scripting (XSS) - Reflected in nuxt/framework

Risk 38
Severity
6.1
First published (updated )
CVE-2022-4413

Nuxt frameworkCross-site Scripting (XSS) - DOM in nuxt/framework

Risk 38
Severity
6.1
First published (updated )
CVE-2022-4414

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203