CVE-2026-47200: Improper Access Control

Nuxt is an open-source web development framework for Vue.js. In Nuxt versions 3.11.0 to before 3.21.6 and 4.0.0-alpha.1 to before 4.4.6 and @nuxt/nitro-server versions 3.20.0 to before 3.21.6 and 4.0.0-alpha.1 to before 4.4.6, when experimental.componentIslands is enabled default in Nuxt 4, any...

CVE-2026-46342: Improper Neutralization of Input During Web Page Generation

Nuxt is an open-source web development framework for Vue.js. In Nuxt versions 3.1.0 to before 3.21.6 and 4.0.0-alpha.1 to before 4.4.6 and @nuxt/nitro-server versions 3.20.0 to before 3.21.6 and 4.0.0-alpha.1 to before 4.4.6, the /nuxtisland/ endpoint accepts attacker-controlled props query/body...

Amazon Linux 2 : docker, --advisory ALAS2NITRO-ENCLAVES-2026-110 (ALASNITRO-ENCLAVES-2026-110)

The version of docker installed on the remote host is prior to 25.0.16-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2NITRO-ENCLAVES-2026-110 advisory. Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service. CVE-2026-25680...

CVE-2025-69624

Nitro PDF Pro for Windows 14.41.1.4 contains a NULL pointer dereference vulnerability in the JavaScript implementation of app.alert. When app.alert is called with more than one argument and the first argument evaluates to null for example, app.alertapp.activeDocs, true when app.activeDocs is null...

CVE-2025-66769

A NULL pointer dereference in Nitro PDF Pro for Windows v14.41.1.4 allows attackers to cause a Denial of Service DoS via a crafted XFA packet...

CVE-2026-44373

Nitro is a next generation server toolkit. Prior to 3.0.260429-beta, an attacker could bypass a proxy route rule by sending percent-encoded path traversal ..%2f in the URL, causing Nitro to forward a request that the upstream resolved outside the configured scope. This vulnerability is fixed in...

CVE-2026-44372

Nitro is a next generation server toolkit. Prior to 3.0.260429-beta, an attacker could turn a redirect route rule using wildcards rewrite into a cross-host redirect by sliding an extra slash in after the rule prefix. This vulnerability is fixed in 3.0.260429-beta...

@geode/opengeodeweb-front (>=9.13.1-rc.9, <=10.0.2-rc.4), nuxt (>=3.20.0, <=3.21.5) potentially affected by CVE-2026-47200 via @nuxt/nitro-server (>=3.20.0, <=3.21.5)

@nuxt/nitro-server NPM version =3.20.0, =9.13.1-rc.9, =3.20.0, =3.21.5 Source cves: CVE-2026-47200 Source advisory: SNYK:JS-NUXTNITROSERVER-17111073...

@geode/opengeodeweb-front (>=9.13.1-rc.9, <=10.0.2-rc.4), nuxt (>=3.20.0, <=3.21.5) potentially affected by CVE-2026-47200 via @nuxt/nitro-server (>=3.20.0, <=3.21.5)

@nuxt/nitro-server NPM version =3.20.0, =9.13.1-rc.9, =3.20.0, =3.21.5 Source cves: CVE-2026-47200 Source advisory: OSV:GHSA-HG3F-28RG-4JXJ...

Authentication Bypass Using an Alternate Path or Channel

Overview @nuxt/nitro-server is a Nitro server integration for Nuxt Affected versions of this package are vulnerable to Authentication Bypass Using an Alternate Path or Channel in the route middleware. An attacker can gain unauthorized access to server-rendered page content by directly requesting...

@bloggrify/bento (>=3.0.0, <=3.0.1), @bloggrify/core (>=3.0.0, <=3.1.2) +16 more potentially affected by CVE-2026-47200 via @nuxt/nitro-server (>=4.2.0, <=4.4.5)

@nuxt/nitro-server NPM version =4.2.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =4.2.2-depup.0, =10.0.2-rc.5, =1.1.11, =1.0.8, =0.4.5, =3.0.0-dev.27, =4.2.0, =0.5.0, =1.0.1, =0.4.0, =0.1.13, =0.2.2 and more Source cves: CVE-2026-47200 Source advisory: OSV:GHSA-HG3F-28RG-4JXJ...

@bloggrify/bento (>=3.0.0, <=3.0.1), @bloggrify/core (>=3.0.0, <=3.1.2) +16 more potentially affected by CVE-2026-47200 via @nuxt/nitro-server (>=4.2.0, <=4.4.5)

@nuxt/nitro-server NPM version =4.2.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =4.2.2-depup.0, =10.0.2-rc.5, =1.1.11, =1.0.8, =0.4.5, =3.0.0-dev.27, =4.2.0, =0.5.0, =1.0.1, =0.4.0, =0.1.13, =0.2.2 and more Source cves: CVE-2026-47200 Source advisory: SNYK:JS-NUXTNITROSERVER-17111073...

[SECURITY] Fedora 43 Update: rust-eif_build-0.2.1-7.fc43

This CLI tool provides a low level path to assemble an enclave image format EIF file used in AWS Nitro Enclaves...

[SECURITY] Fedora 44 Update: rust-eif_build-0.2.1-7.fc44

This CLI tool provides a low level path to assemble an enclave image format EIF file used in AWS Nitro Enclaves...

Amazon Linux 2 : runc, --advisory ALAS2NITRO-ENCLAVES-2026-103 (ALASNITRO-ENCLAVES-2026-103)

The version of runc installed on the remote host is prior to 1.3.4-5. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2NITRO-ENCLAVES-2026-103 advisory. When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memo...

Amazon Linux 2 : docker, --advisory ALAS2NITRO-ENCLAVES-2026-104 (ALASNITRO-ENCLAVES-2026-104)

The version of docker installed on the remote host is prior to 25.0.14-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2NITRO-ENCLAVES-2026-104 advisory. When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C...

@geode/opengeodeweb-front (>=9.13.1-rc.9, <=10.0.2-rc.4), nuxt (>=3.20.0, <=3.21.5) potentially affected by CVE-2026-46342 via @nuxt/nitro-server (>=3.20.0, <=3.21.5)

@nuxt/nitro-server NPM version =3.20.0, =9.13.1-rc.9, =3.20.0, =3.21.5 Source cves: CVE-2026-46342 Source advisory: OSV:GHSA-G8WJ-3CR3-6W7V...

@geode/opengeodeweb-front (>=9.13.1-rc.9, <=10.0.2-rc.4), nuxt (>=3.20.0, <=3.21.5) potentially affected by CVE-2026-46342 via @nuxt/nitro-server (>=3.20.0, <=3.21.5)

@nuxt/nitro-server NPM version =3.20.0, =9.13.1-rc.9, =3.20.0, =3.21.5 Source cves: CVE-2026-46342 Source advisory: SNYK:JS-NUXTNITROSERVER-16770417...

@bloggrify/bento (>=3.0.0, <=3.0.1), @bloggrify/core (>=3.0.0, <=3.1.2) +16 more potentially affected by CVE-2026-46342 via @nuxt/nitro-server (>=4.2.0, <=4.4.5)

@nuxt/nitro-server NPM version =4.2.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =4.2.2-depup.0, =10.0.2-rc.5, =1.1.11, =1.0.8, =0.4.5, =3.0.0-dev.27, =4.2.0, =0.5.0, =1.0.1, =0.4.0, =0.1.13, =0.2.2 and more Source cves: CVE-2026-46342 Source advisory: OSV:GHSA-G8WJ-3CR3-6W7V...

HTTP Request Smuggling

Overview @nuxt/nitro-server is a Nitro server integration for Nuxt Affected versions of this package are vulnerable to HTTP Request Smuggling via the nuxtisland endpoint when responses are not properly bound to request props, allowing shared-cache poisoning. An attacker can cause users to receive...