@depup/nuxt (>=4.6.0-depup.0, <=4.6.2-depup.0), @imaginario27/air-ui-ds (>=1.25.0, <=1.29.1) +6 more potentially affected by CVE-2026-119200 via @nuxt/nitro-server (>=4.6.0, <=4.6.2)

@nuxt/nitro-server NPM version =4.6.0, =4.6.0-depup.0, =1.25.0, =1.0.28, =4.6.0, =0.4.0-alpha.1, =1.0.28, =1.0.39 Source cves: CVE-2026-119200 Source advisory: OSV:GHSA-9V7C-Q64Q-VV33...

@depup/nuxt (>=4.6.0-depup.0, <=4.6.2-depup.0), @imaginario27/air-ui-ds (>=1.25.0, <=1.29.1) +6 more potentially affected by CVE-2026-119200 via @nuxt/nitro-server (>=4.6.0, <=4.6.2)

@nuxt/nitro-server NPM version =4.6.0, =4.6.0-depup.0, =1.25.0, =1.0.28, =4.6.0, =0.4.0-alpha.1, =1.0.28, =1.0.39 Source cves: CVE-2026-119200 Source advisory: GHSA-9V7C-Q64Q-VV33...

@depup/nuxt (>=4.6.0-depup.0, <=4.6.2-depup.0), @imaginario27/air-ui-ds (>=1.25.0, <=1.29.1) +6 more potentially affected by CVE-2026-119200 via @nuxt/nitro-server (>=4.6.0, <=4.6.2)

@nuxt/nitro-server NPM version =4.6.0, =4.6.0-depup.0, =1.25.0, =1.0.28, =4.6.0, =0.4.0-alpha.1, =1.0.28, =1.0.39 Source cves: CVE-2026-119200 Source advisory: MEND:CVE-2026-119200...

@abbele/core (>=0.0.1, <=0.0.10), @abbele/uikit (>=0.0.1, <=0.1.2) +379 more potentially affected by CVE-2026-114132 via @nuxt/nitro-server (>=3.20.0, <=4.6.1)

@nuxt/nitro-server NPM version =3.20.0, =0.0.1, =0.0.1, =1.2.3, =0.0.3, =0.2.9, =0.0.1, =0.0.1, =0.1.0, =0.1.1, =0.1.0, =1.0.4, =1.0.4, =1.0.5 and more Source cves: CVE-2026-114132 Source advisory: SNYK:JS-NUXTNITROSERVER-21431482...

Incorrect Authorization

Overview @nuxt/nitro-server is a Nitro server integration for Nuxt Affected versions of this package are vulnerable to Incorrect Authorization via case-sensitive matching of server-side route rules, where route rule protections such as redirect, headers, and proxy rules can be bypassed by an...

@bloggrify/bento (>=3.0.0, <=3.1.0), @bloggrify/core (>=3.0.0, <=3.3.0) +23 more potentially affected by CVE-2026-114132 via @nuxt/nitro-server (>=4.2.0, <=4.6.1)

@nuxt/nitro-server NPM version =4.2.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =4.2.2-depup.0, =10.0.2-rc.5, =1.1.11, =1.0.8, =1.6.0-rc.3, =0.4.5, =0.15.0, =0.1.0, =3.0.0-dev.27, =4.3.6 and more Source cves: CVE-2026-114132 Source advisory: GHSA-VJH5-4X84-XRQP...

@abbele/core (>=0.0.1, <=0.0.10), @abbele/uikit (>=0.0.1, <=0.1.2) +482 more potentially affected by CVE-2026-114132 via @nuxt/nitro-server (>=3.20.0, <=4.6.3)

@nuxt/nitro-server NPM version =3.20.0, =0.0.1, =0.0.1, =0.0.0, =1.2.3, =0.0.3, =0.2.9, =0.0.1, =0.0.1, =1.1.1, =1.0.0, =0.1.0, =0.1.1, =0.6.15 and more Source cves: CVE-2026-114132 Source advisory: OSV:GHSA-VJH5-4X84-XRQP...

@abbele/core (>=0.0.1, <=0.0.10), @abbele/uikit (>=0.0.1, <=0.1.2) +358 more potentially affected by CVE-2026-114132 via @nuxt/nitro-server (>=3.20.0, <=3.21.11)

@nuxt/nitro-server NPM version =3.20.0, =0.0.1, =0.0.1, =1.2.3, =0.0.3, =0.2.9, =0.0.1, =0.0.1, =0.1.0, =0.1.1, =0.1.0, =1.0.4, =1.0.4, =1.0.5 and more Source cves: CVE-2026-114132 Source advisory: GHSA-VJH5-4X84-XRQP...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the server island head rendering pipeline in packages/nitro-server/src/runtime/handlers/island.ts, where head entries are serialized without applying the useHeadSafe allowlist. An attacker who can influence...

@bloggrify/bento (>=3.0.0, <=3.1.0), @bloggrify/core (>=3.0.0, <=3.3.0) +23 more potentially affected by CVE-2026-114133 via @nuxt/nitro-server (>=4.2.0, <=4.6.1)

@nuxt/nitro-server NPM version =4.2.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =4.2.2-depup.0, =10.0.2-rc.5, =1.1.11, =1.0.8, =1.6.0-rc.3, =0.4.5, =0.15.0, =0.1.0, =3.0.0-dev.27, =4.3.6 and more Source cves: CVE-2026-114133 Source advisory: MEND:CVE-2026-114133...

@bloggrify/bento (>=3.0.0, <=3.1.0), @bloggrify/core (>=3.0.0, <=3.3.0) +23 more potentially affected by CVE-2026-114132 via @nuxt/nitro-server (>=4.2.0, <=4.6.1)

@nuxt/nitro-server NPM version =4.2.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =4.2.2-depup.0, =10.0.2-rc.5, =1.1.11, =1.0.8, =1.6.0-rc.3, =0.4.5, =0.15.0, =0.1.0, =3.0.0-dev.27, =4.3.6 and more Source cves: CVE-2026-114132 Source advisory: MEND:CVE-2026-114132...

@geode/opengeodeweb-front (>=9.13.1-rc.9, <=10.0.2-rc.4), nuxt (>=3.20.0, <=3.21.2) potentially affected by CVE-2026-114131 via @nuxt/nitro-server (>=3.20.0, <=3.21.2)

@nuxt/nitro-server NPM version =3.20.0, =9.13.1-rc.9, =3.20.0, =3.21.2 Source cves: CVE-2026-114131 Source advisory: MEND:CVE-2026-114131...

@bloggrify/bento (>=3.0.0, <=3.0.1), @bloggrify/core (>=3.0.0, <=3.1.2) +16 more potentially affected by CVE-2026-114131 via @nuxt/nitro-server (>=4.2.0, <=4.4.2)

@nuxt/nitro-server NPM version =4.2.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =4.2.2-depup.0, =10.0.2-rc.5, =1.1.11, =1.0.8, =0.4.5, =3.0.0-dev.27, =4.2.0, =0.5.0, =1.0.1, =0.4.0, =0.1.13, =0.2.2 and more Source cves: CVE-2026-114131 Source advisory: MEND:CVE-2026-114131...

Information Exposure

Overview @nuxt/nitro-server is a Nitro server integration for Nuxt Affected versions of this package are vulnerable to Information Exposure through the Chrome DevTools workspace endpoint in packages/nitro-server/src/index.ts. An attacker can retrieve the project’s absolute filesystem root and...

@qingwave/cclens (>=0.1.0, <=0.2.0), nuxt (>=3.21.7, <=3.21.9) potentially affected by unknown CVE via @nuxt/nitro-server (>=3.21.7, <=3.21.9)

@nuxt/nitro-server NPM version =3.21.7, =0.1.0, =3.21.7, =3.21.9 Source cves: unknown CVE Source advisory: SNYK:JS-NUXTNITROSERVER-18857957...

@bloggrify/bento (3.1.0), @bloggrify/core (>=3.2.0, <=3.3.0) +15 more potentially affected by unknown CVE via @nuxt/nitro-server (>=4.4.7, <=4.5.0)

@nuxt/nitro-server NPM version =4.4.7, =3.2.0, =4.5.0-depup.0, =1.13.12, =1.2.5, =1.6.0-rc.3, =1.0.0-alpha.17, =0.15.0, =0.1.0, =1.0.0, =4.4.7, =0.6.0-rc.4, =0.2.3, =0.3.0-alpha.2 and more Source cves: unknown CVE Source advisory: SNYK:JS-NUXTNITROSERVER-18857957...

@bloggrify/bento (3.1.0), @bloggrify/core (>=3.2.0, <=3.3.0) +15 more potentially affected by CVE-2026-72744 via @nuxt/nitro-server (>=4.4.7, <=4.5.0)

@nuxt/nitro-server NPM version =4.4.7, =3.2.0, =4.5.0-depup.0, =1.13.12, =1.2.5, =1.6.0-rc.3, =1.0.0-alpha.17, =0.15.0, =0.1.0, =1.0.0, =4.4.7, =0.6.0-rc.4, =0.2.3, =0.3.0-alpha.2 and more Source cves: CVE-2026-72744 Source advisory: SNYK:JS-NUXTNITROSERVER-18593816...

@qingwave/cclens (>=0.1.0, <=0.2.0), nuxt (>=3.21.7, <=3.21.9) potentially affected by CVE-2026-72744 via @nuxt/nitro-server (>=3.21.7, <=3.21.9)

@nuxt/nitro-server NPM version =3.21.7, =0.1.0, =3.21.7, =3.21.9 Source cves: CVE-2026-72744 Source advisory: SNYK:JS-NUXTNITROSERVER-18593816...

Information Exposure

Overview @nuxt/nitro-server is a Nitro server integration for Nuxt Affected versions of this package are vulnerable to Information Exposure via the Chrome DevTools workspace endpoint when the development server is bound to a network-reachable interface and experimental.chromeDevtoolsProjectSettin...

Allocation of Resources Without Limits or Throttling

Overview @nuxt/nitro-server is a Nitro server integration for Nuxt Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the island renderer endpoint when attacker-controlled input is decoded and hashed before URL-resident hash validation. An...