CVE-2026-123808

The Nuxt UI Vue UI library is vulnerable in versions prior to 4.8.1 due to how the UForm component in src/runtime/components/Form.vue handles form submissions. The server-rendered form omits method and action attributes, relying entirely on a hydrated @submit.prevent handler. If a user submits th...

PT-2026-57595

Summary UForm and UAuthForm render a server-side element with no method and no action attribute, relying on a hydrated @submit.prevent handler to intercept submission. If a user submits the form before Vue hydration has attached the handler autofill plus Enter on a slow network, JS bundle blocked...