13 matches found
EUVD-2026-107414
Nuxt: Route rules are matched against the raw request path, so a percent-encoded segment can bypass appMiddleware on dynamic and catch-all routes...
CVE-2026-114131
Nuxt is an open-source web development framework for Vue.js. From 3.11.0 until 3.21.4 and 4.4.4, Nuxt compares route-rule keys with the raw request path while route resolution decodes dynamic and catch-all parameters, allowing a percent-encoded segment to resolve to a protected page without...
PT-2026-120734
Name of the Vulnerable Software and Affected Versions Nuxt versions 3.11.0 through 3.21.3 Nuxt versions 4.0.0 through 4.4.3 Description Nuxt compares route-rule keys with the raw request path, whereas route resolution decodes dynamic and catch-all parameters. This discrepancy allows a...
NPM: Hono: `memo()` retains SSR output across requests, leading to cross-user data disclosure
NPM: Hono: memo retains SSR output across requests, leading to cross-user data disclosure vulnerability discovered by ? in WordPress Npm hono versions = 3.8.0, 4.12.34...
NPM: Nuxt runtime payload cache discloses another user's SSR data across users and to unauthenticated clients
NPM: Nuxt runtime payload cache discloses another user's SSR data across users and to unauthenticated clients vulnerability discovered by ? in WordPress Npm nuxt versions = 4.4.0, = 4.5.0...
CVE-2026-71316
Nuxt is an open-source web development framework for Vue.js. From 4.4.0 until 4.5.1, runtime cache:nuxt:payload entries for //payload.json can be returned before route middleware and page guards because import.meta.prerender is not enforced, disclosing another user's SSR data. This issue is fixed...
CVE-2026-71316 Nuxt runtime payload cache discloses another user's SSR data across users and to unauthenticated clients
Nuxt is an open-source web development framework for Vue.js. From 4.4.0 until 4.5.1, runtime cache:nuxt:payload entries for //payload.json can be returned before route middleware and page guards because import.meta.prerender is not enforced, disclosing another user's SSR data. This issue is fixed...
CVE-2026-71316
CVE-2026-71316 affects Nuxt (Vue.js framework). From 4.4.0 through 4.5.1, runtime cache:nuxt:payload entries for //_payload.json could be returned before route middleware and page guards because import.meta.prerender was not enforced, potentially disclosing another user’s SSR data. The issue is f...
CVE-2026-71316 Nuxt runtime payload cache discloses another user's SSR data across users and to unauthenticated clients
Nuxt is an open-source web development framework for Vue.js. From 4.4.0 until 4.5.1, runtime cache:nuxt:payload entries for //payload.json can be returned before route middleware and page guards because import.meta.prerender is not enforced, disclosing another user's SSR data. This issue is fixed...
CVE-2026-71316
Nuxt is an open-source web development framework for Vue.js. From 4.4.0 until 4.5.1, runtime cache:nuxt:payload entries for //payload.json can be returned before route middleware and page guards because import.meta.prerender is not enforced, disclosing another user's SSR data. This issue is fixed...
CVE-2026-71316: Use of Cache Containing Sensitive Information
Nuxt is an open-source web development framework for Vue.js. From 4.4.0 until 4.5.1, runtime cache:nuxt:payload entries for / /payload.json can be returned before route middleware and page guards because import.meta.prerender is not enforced, disclosing another user's SSR data. This issue is fixe...
MAL-2025-1627 Malicious code in ssr-data-router (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2c6353bffc74b93b29b361e25a27b4a814f6e863985adaad92a91572071fba6c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in ssr-data-router (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2c6353bffc74b93b29b361e25a27b4a814f6e863985adaad92a91572071fba6c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...