Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

Overview Affected versions of this package are vulnerable to Use of Externally-Controlled Input to Select Classes or Code 'Unsafe Reflection' via the as prop in server island components that forward attacker-controlled values into dynamic component resolution. An attacker can instantiate any...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the route rule matching. An attacker can gain unauthorized access to protected pages and sensitive data by crafting requests to mixed-case paths that bypass authentication middleware. Workaround This...

Incorrect Authorization

Overview @nuxt/nitro-server is a Nitro server integration for Nuxt Affected versions of this package are vulnerable to Incorrect Authorization in the route rule matching. An attacker can gain unauthorized access to protected pages and sensitive data by crafting requests to mixed-case paths that...

Improper Validation of Specified Quantity in Input

Overview Affected versions of this package are vulnerable to Improper Validation of Specified Quantity in Input via the v-for in server-side rendering of islands or server components. An attacker can cause the server to allocate excessive memory and crash by sending a request with a large integer...

Open Redirect

Overview Affected versions of this package are vulnerable to Open Redirect via improper handling of URLs in the navigateTo function. An attacker can execute arbitrary scripts or redirect users to malicious sites by supplying crafted URLs that exploit path normalization and protocol-relative...

PT-2026-53035

Impact Nuxt's globally registered component from @unhead/vue head components, re-exported by Nuxt wrote its default-slot content to the innerHTML of the head tag, bypassing the HTML escaping that interpolation normally applies in Vue templates. Applications that placed untrusted,...

Exposure of Sensitive System Information to an Unauthorized Control Sphere

Overview Affected versions of this package are vulnerable to Exposure of Sensitive System Information to an Unauthorized Control Sphere via the unauthenticated /.well-known/appspecific/com.chrome.devtools.json endpoint, which exposes the absolute filesystem path of the project and a persistent...

Improper Handling of Case Sensitivity

Overview Affected versions of this package are vulnerable to Improper Handling of Case Sensitivity through the getRouteRules function in the route rules matcher. An attacker can evade prerender, SSR, or redirect rules by sending a request with a path that uses different letter casing from the...

Authentication Bypass Using an Alternate Path or Channel

Overview Affected versions of this package are vulnerable to Authentication Bypass Using an Alternate Path or Channel in the route middleware. An attacker can gain unauthorized access to server-rendered page content by directly requesting the /nuxtisland/page endpoint, bypassing authentication or...

HTTP Request Smuggling

Overview Affected versions of this package are vulnerable to HTTP Request Smuggling via the nuxtisland endpoint when responses are not properly bound to request props, allowing shared-cache poisoning. An attacker can cause users to receive attacker-controlled HTML by priming a shared cache with...