626 matches found
CVE-2026-71314 Nuxt: Unauthenticated out-of-memory crash via unbounded v-for expansion in island rendering
Nuxt is an open-source web development framework for Vue.js. From 3.1.0 until 3.21.10 and 4.5.1, an unauthenticated attacker can use a server island v-for prop, including vforToArray and , to trigger unbounded SSR memory allocation until MAXVFORLENGTH = 100000 and crash the Nuxt process. This iss...
CVE-2026-71314 Nuxt: Unauthenticated out-of-memory crash via unbounded v-for expansion in island rendering
Nuxt is an open-source web development framework for Vue.js. From 3.1.0 until 3.21.10 and 4.5.1, an unauthenticated attacker can use a server island v-for prop, including vforToArray and , to trigger unbounded SSR memory allocation until MAXVFORLENGTH = 100000 and crash the Nuxt process. This iss...
CLSA-2026-1775781171 TuxCare security update for nuxt (2 CVEs)
TuxCare rebuilt nuxt to address 2 CVEs. Fixed in 1.4.5-tuxcare.1...
Malicious code in load-nuxt-dev (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cf0f879297070c07197ace88cfb411c61d497ad150e39c2c5c91349737f5d83a The package name resembles the legitimate Nuxt ecosystem tooling e.g., @nuxt/load-nuxt, and the version 99.0.3 is a common dependency-confusion /...
Malicious code in nuxt-fonts-devtools (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d6ede5024b6ee71356eedb3dfb3bb648682901bf6b966bbe353daff6082ecc85 Package ships only a package.json and a readme; there is no main entry, no bin, no scripts, no dependencies, and no executable code. The readme...
Malicious code in load-nuxt (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d5e95bb337136d6bfafcd6f21bb8cb1d98da703f7e20b851b3af82876018ffac Package name resembles the Nuxt ecosystem's helper naming 'load-nuxt' and is published at version 99.0.3, a version-number shape frequently used in...
MAL-2026-6934 Malicious code in load-nuxt (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d5e95bb337136d6bfafcd6f21bb8cb1d98da703f7e20b851b3af82876018ffac Package name resembles the Nuxt ecosystem's helper naming 'load-nuxt' and is published at version 99.0.3, a version-number shape frequently used in...
MAL-2026-6937 Malicious code in nuxt-fonts-devtools (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d6ede5024b6ee71356eedb3dfb3bb648682901bf6b966bbe353daff6082ecc85 Package ships only a package.json and a readme; there is no main entry, no bin, no scripts, no dependencies, and no executable code. The readme...
MAL-2026-6935 Malicious code in load-nuxt-dev (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cf0f879297070c07197ace88cfb411c61d497ad150e39c2c5c91349737f5d83a The package name resembles the legitimate Nuxt ecosystem tooling e.g., @nuxt/load-nuxt, and the version 99.0.3 is a common dependency-confusion /...
@falcondev-oss/nuxt-layers-base (>=0.1.0, <=0.25.0), @iqual/nuxt-icms (>=1.6.0-rc.1, <=1.6.1) +25 more potentially affected by unknown CVE via @nuxt/ui (>=4.0.0, <=4.8.0)
@nuxt/ui NPM version =4.0.0, =0.1.0, =1.6.0-rc.1, =1.1.6, =0.0.19, =0.5.0, =0.0.7, =0.0.0-test-ld-20260520212549, =0.0.0-test-ld-20260520212549, =0.9.0, =0.0.0-test-ld-20260520212549, =0.0.0-test-ld-20260520212549, =0.4.0, =0.4.0, =1.1.0, =1.0.1, =1.1.4 and more Source cves: unknown CVE Source...
@falcondev-oss/nuxt-layers-base (>=0.1.0, <=0.25.0), @iqual/nuxt-icms (>=1.6.0-rc.1, <=1.6.1) +25 more potentially affected by unknown CVE via @nuxt/ui (>=4.0.0, <=4.8.0)
@nuxt/ui NPM version =4.0.0, =0.1.0, =1.6.0-rc.1, =1.1.6, =0.0.19, =0.5.0, =0.0.7, =0.0.0-test-ld-20260520212549, =0.0.0-test-ld-20260520212549, =0.9.0, =0.0.0-test-ld-20260520212549, =0.0.0-test-ld-20260520212549, =0.4.0, =0.4.0, =1.1.0, =1.0.1, =1.1.4 and more Source cves: unknown CVE Source...
kmcom-nuxt-layers (>=2.2.0, <=2.2.12) potentially affected by CVE-2026-59194 via pnpm (11.5.3)
pnpm NPM version 11.5.3 is affected by a known vulnerability. The following packages have a transitive dependency on pnpm and may be impacted: - kmcom-nuxt-layers =2.2.0, =2.2.12 Source cves: CVE-2026-59194 Source advisory: OSV:GHSA-72R4-9C5J-MJ57...
kmcom-nuxt-layers (>=2.2.0, <=2.2.12) potentially affected by CVE-2026-59194 via pnpm (11.5.3)
pnpm NPM version 11.5.3 is affected by a known vulnerability. The following packages have a transitive dependency on pnpm and may be impacted: - kmcom-nuxt-layers =2.2.0, =2.2.12 Source cves: CVE-2026-59194 Source advisory: SNYK:JS-PNPM-17661047...
kmcom-nuxt-layers (>=2.2.0, <=2.2.12) potentially affected by CVE-2026-59196 via pnpm (11.5.3)
pnpm NPM version 11.5.3 is affected by a known vulnerability. The following packages have a transitive dependency on pnpm and may be impacted: - kmcom-nuxt-layers =2.2.0, =2.2.12 Source cves: CVE-2026-59196 Source advisory: SNYK:JS-PNPM-17660537...
kmcom-nuxt-layers (>=2.2.0, <=2.2.12) potentially affected by CVE-2026-59196 via pnpm (11.5.3)
pnpm NPM version 11.5.3 is affected by a known vulnerability. The following packages have a transitive dependency on pnpm and may be impacted: - kmcom-nuxt-layers =2.2.0, =2.2.12 Source cves: CVE-2026-59196 Source advisory: OSV:GHSA-FR4H-3CPH-29XV...
Open Redirect
Nuxt is vulnerable to open redirect. The vulnerability is due to improper validation of path-normalized URLs in navigateTo, where specially crafted paths can bypass external-host checks after normalization, allowing attackers to redirect users to malicious websites and facilitate phishing attacks...
CVE-2026-56301
Nuxt 4.0.0 before 4.4.7 and 3.18.0 before 3.21.7, when running the development server nuxt dev on Linux, binds the vite-node IPC server to an abstract-namespace Unix socket without permission restrictions, allowing local users to enumerate and connect. Unprivileged co-resident users can exploit t...
CVE-2026-56301
Nuxt 4.0.0 before 4.4.7 and 3.18.0 before 3.21.7, when running the development server nuxt dev on Linux, binds the vite-node IPC server to an abstract-namespace Unix socket without permission restrictions, allowing local users to enumerate and connect. Unprivileged co-resident users can exploit t...
CVE-2026-56301 Nuxt - Arbitrary File Read via World-Connectable vite-node IPC Socket on Linux
Nuxt 4.0.0 before 4.4.7 and 3.18.0 before 3.21.7, when running the development server nuxt dev on Linux, binds the vite-node IPC server to an abstract-namespace Unix socket without permission restrictions, allowing local users to enumerate and connect. Unprivileged co-resident users can exploit t...
EUVD-2026-38436
Nuxt 4.0.0 before 4.4.7 and 3.18.0 before 3.21.7, when running the development server nuxt dev on Linux, binds the vite-node IPC server to an abstract-namespace Unix socket without permission restrictions, allowing local users to enumerate and connect. Unprivileged co-resident users can exploit t...