nuxt vulnerabilities

CVEs per yearBy the year they were published

1. 20222
2. 20232
3. 20244
4. 20254
5. 202630

Newest CVEs

• CVE-2026-102650

  Nuxt Content: Unauthenticated SQLite Function DoS via Content Query API

  nuxt · content

  High7.5
• CVE-2026-120309

  Nuxt 4.6.0 before 4.6.2 Route Param Confusion via getRouterParam

  nuxt · nuxt

  Medium6.3
• CVE-2026-119201

  Nuxt dev server exposes generated appSecret through Vite file serving

  nuxt · nuxt

  Medium4.8
• CVE-2026-119200

  Nuxt: Dot segments in the request path bypass `server/middleware` path checks and server route rules on page routes

  nuxt · nuxt

  Medium6.5
• CVE-2026-119199

  Nuxt dev server exposes private runtime config through the Nitro dev bundle

  nuxt · nuxt

  Medium5.9
• CVE-2026-119198

  Nuxt dev server arbitrary file read through client error reports

  nuxt · nuxt

  Medium5.9
• CVE-2026-114133

  Nuxt server islands render `useHeadSafe` input without sanitisation

  nuxt · nuxt

  Medium5.4
• CVE-2026-114132

  Nuxt: Server-side route rules (`redirect`, `headers`, `proxy`, `ssr`) are skipped for case-variant paths when routing is case-insensitive

  nuxt · nuxt

  Medium6.3
• CVE-2026-114131

  Nuxt: Route rules are matched against the raw request path, so a percent-encoded segment can bypass `appMiddleware` on dynamic and catch-all routes

  nuxt · nuxt

  Medium6.5
• CVE-2026-114130

  Nuxt: Incomplete fix for GHSA-934w-87qh-qr26: a `javascript:` URL prefixed with an ASCII control character executes from `<NuxtLink>` when `pages` is disabled

  nuxt · nuxt

  Low2.3