CVE-2026-114130 nuxt CVE debrief

Who should care

Defenders responsible for Nuxt applications, particularly those using `<NuxtLink>` with untrusted input, should assess exposure and prioritize verification and remediation efforts.

Why it matters

CVE-2026-114130 is an incomplete fix for a vulnerability in Nuxt, allowing attackers to inject JavaScript code in applications with `pages` disabled. Defenders should prioritize verification, remediation, and monitoring efforts.

• Code injection and execution in application's origin
• Potential for attackers to steal sensitive data or take control of user sessions
• Possible disruption of application functionality or availability
• Need for verification of Nuxt version and exposure in environment

Technical summary

The vulnerability affects Nuxt applications with `pages` disabled, allowing attackers to inject JavaScript code via a specially crafted `javascript:` URL prefixed with an ASCII control character. This is an incomplete fix for GHSA-934w-87qh-qr26 (CVE-2026-53722). The application must have `pages` disabled (no `pages/` directory, or `pages: false`). Prefixing `javascript:` with an ASCII C0 control character, for example `%01`, meant the value was not recognised as having a protocol. It was classified as an internal route and so never reached the protocol check added in GHSA-934w-87qh-qr26.

Defensive priority

Defenders should prioritize verifying and upgrading to Nuxt version 4.6.0 or later, reviewing applications using `<NuxtLink>` with untrusted input, and assessing exposure in their environment.

Recommended defensive actions

• Verify and upgrade to Nuxt version 4.6.0 or later
• Review applications using `<NuxtLink>` with untrusted input
• Assess exposure in environment
• Monitor for potential exploitation attempts
• Perform vulnerability scanning
• Implement compensating controls
• Track exceptions and retest remediated assets

Evidence notes

The CVE record and source item provide details on the vulnerability, its impact, and mitigating factors. The NVD entry is currently unavailable. Defenders should verify Nuxt version and exposure in their environment with explicit evidence-limit language and defensive verification tasks. CVE-2026-114130 affects applications with `pages` disabled, allowing attackers to inject JavaScript code via a specially crafted `javascript:` URL prefixed with an ASCII control character. This is an incomplete fix for GHSA-934w-87qh-qr26 (CVE-2026-537

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.