CVE-2026-72744-poc

CVE-2026-72744: Nuxt Chrome DevTools endpoint information disclosure PoC Japanese version Overview This repository reproduces CVE-2026-72744 , an information disclosure in Nuxt's development-only Chrome DevTools workspace endpoint. The vulnerable server uses attacker-controlled HTTP headers,...

Malware in @kibt/www-nuxt-i18n

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

EUVD-2026-107416

Nuxt: Server-side route rules redirect, headers, proxy, ssr are skipped for case-variant paths when routing is case-insensitive...

npm: Nuxt: Server-side route rules (`redirect`, `headers`, `proxy`, `ssr`) are skipped for case-variant paths when routing is case-insensitive

npm: Nuxt: Server-side route rules redirect, headers, proxy, ssr are skipped for case-variant paths when routing is case-insensitive vulnerability discovered by ? in WordPress npm nuxt versions = 3.0.0, 4.0.0...

EUVD-2026-107417

Nuxt server islands render useHeadSafe input without sanitisation...

npm: Nuxt server islands render `useHeadSafe` input without sanitisation

npm: Nuxt server islands render useHeadSafe input without sanitisation vulnerability discovered by ? in WordPress npm nuxt versions = 3.13.0, 4.6.2...

EUVD-2026-107413

Nuxt: Incomplete fix for GHSA-934w-87qh-qr26: a javascript: URL prefixed with an ASCII control character executes from when pages is disabled...

npm: Nuxt: Incomplete fix for GHSA-934w-87qh-qr26: a `javascript:` URL prefixed with an ASCII control character executes from `<NuxtLink>` when `pages` is disabled

npm: Nuxt: Incomplete fix for GHSA-934w-87qh-qr26: a javascript: URL prefixed with an ASCII control character executes from when pages is disabled vulnerability discovered by ? in WordPress npm nuxt versions 4.6.0...

EUVD-2026-107414

Nuxt: Route rules are matched against the raw request path, so a percent-encoded segment can bypass appMiddleware on dynamic and catch-all routes...

npm: Nuxt: Route rules are matched against the raw request path, so a percent-encoded segment can bypass `appMiddleware` on dynamic and catch-all routes

npm: Nuxt: Route rules are matched against the raw request path, so a percent-encoded segment can bypass appMiddleware on dynamic and catch-all routes vulnerability discovered by ? in WordPress npm nuxt versions = 3.11.0, 3.21.4...

CVE-2026-114133

Nuxt is an open-source web development framework for Vue.js. From 3.13.0 until 4.6.2, the server-island renderer serializes raw useHeadSafe entry input into the island response without preserving the safe-input marker, and NuxtIsland later inserts that input into the page head as an ordinary entr...

CVE-2026-114132

Nuxt is an open-source web development framework for Vue.js. Prior to 4.6.2, Nuxt resolves pages case-insensitively by default while Nitro matches server-side route-rule keys case-sensitively, allowing a request whose path differs only by letter case to render without the server rule intended for...

CVE-2026-114130

Nuxt is an open-source web development framework for Vue.js. Prior to 4.6.0, an incomplete fix for CVE-2026-53722 allows an application with pages disabled to render a script-capable URL through NuxtLink when attacker-controlled input bound to to is prefixed with an ASCII C0 control character. Th...

CVE-2026-114131

Nuxt is an open-source web development framework for Vue.js. From 3.11.0 until 3.21.4 and 4.4.4, Nuxt compares route-rule keys with the raw request path while route resolution decodes dynamic and catch-all parameters, allowing a percent-encoded segment to resolve to a protected page without...

CVE-2026-114133 Nuxt server islands render `useHeadSafe` input without sanitisation

Nuxt is an open-source web development framework for Vue.js. From 3.13.0 until 4.6.2, the server-island renderer serializes raw useHeadSafe entry input into the island response without preserving the safe-input marker, and NuxtIsland later inserts that input into the page head as an ordinary entr...

CVE-2026-114133

The Nuxt web development framework (versions 3.13.0 through 4.6.2 ) contains a vulnerability where the server-island renderer serializes raw useHeadSafe entry input into the island response without preserving the safe-input marker. This causes NuxtIsland to subsequently insert that input into the...

CVE-2026-114132 Nuxt: Server-side route rules (`redirect`, `headers`, `proxy`, `ssr`) are skipped for case-variant paths when routing is case-insensitive

Nuxt is an open-source web development framework for Vue.js. Prior to 4.6.2, Nuxt resolves pages case-insensitively by default while Nitro matches server-side route-rule keys case-sensitively, allowing a request whose path differs only by letter case to render without the server rule intended for...

CVE-2026-114132 Nuxt: Server-side route rules (`redirect`, `headers`, `proxy`, `ssr`) are skipped for case-variant paths when routing is case-insensitive

Nuxt is an open-source web development framework for Vue.js. Prior to 4.6.2, Nuxt resolves pages case-insensitively by default while Nitro matches server-side route-rule keys case-sensitively, allowing a request whose path differs only by letter case to render without the server rule intended for...

CVE-2026-114132

The Nuxt web development framework is vulnerable prior to version 4.6.2 due to a discrepancy in how it handles case sensitivity. While Nuxt resolves pages case-insensitively by default, the Nitro engine matches server-side route-rule keys case-sensitively. This allows requests with paths differin...

CVE-2026-114131

The Nuxt web development framework (versions 3.11.0 up to 3.21.4 and 4.4.4) is vulnerable to a security bypass due to an interpretation conflict . The framework compares route-rule keys against the raw request path while decoding dynamic and catch-all parameters during route resolution. An attack...