PatchSiren cyber security CVE debrief
CVE-2026-56697 Nuxt CVE debrief
CVE-2026-56697 is a medium-severity vulnerability in Nuxt versions 4.0.0 before 4.4.7 and 3.x before 3.21.7. The vulnerability allows attackers to inject protocol-relative paths, such as //evil.com, into the reloadNuxtApp function. This can lead to cross-origin URL resolution against the current page protocol, enabling phishing and OAuth authorization-code theft. The vulnerability has a CVSS score of 5.3 and is classified as MEDIUM. The CVE was published on 2026-06-22T22:16:52.650Z and last modified on 2026-06-25T16:55:20.860Z.
- Vendor
- Nuxt
- Product
- Unknown
- CVSS
- MEDIUM 5.3
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-06-22
- Original CVE updated
- 2026-06-25
- Advisory published
- 2026-06-22
- Advisory updated
- 2026-06-25
Who should care
Developers and administrators using Nuxt versions 4.0.0 before 4.4.7 and 3.x before 3.21.7 should be aware of this vulnerability. Attackers can exploit this vulnerability to redirect users to malicious sites, potentially leading to phishing and OAuth authorization-code theft. Users of affected versions should prioritize patching to prevent potential attacks.
Technical summary
The vulnerability in Nuxt arises from the acceptance of protocol-relative paths, such as //evil.com, in the reloadNuxtApp function. These paths pass the script-protocol check but resolve to a cross-origin URL against the current page protocol. This allows attackers to inject paths like //evil.com to redirect users to attacker-controlled hosts. The vulnerability is classified under CWE-601, indicating a URL Redirection to Untrusted Site ('Open Redirect').
Defensive priority
Patching to the latest version of Nuxt is highly recommended. Developers should update to version 4.4.7 or later for 4.x versions and 3.21.7 or later for 3.x versions.
Recommended defensive actions
- Patch to the latest version of Nuxt.
- Review and update affected Nuxt applications.
- Monitor for suspicious redirect activity.
- Implement additional security measures for OAuth authorization flows.
- Educate users about phishing risks.
Evidence notes
The CVE-2026-56697 vulnerability was published in the NVD database and has a CVSS score of 5.3. The vulnerability affects Nuxt versions 4.0.0 before 4.4.7 and 3.x before 3.21.7. Limited information is available about the specific exploits or attacks in the wild.
Sources and references
Verified primary and authoritative sources
-
CVE-2026-56697 CVE Program record
Publisher, destination, and source semantics verified
URL: https://www.cve.org/CVERecord?id=CVE-2026-56697
CVE Program - Official CVE Program record with source-provided CVE metadata.
-
CVE-2026-56697 NVD vulnerability detail
Publisher, destination, and source semantics verified
URL: https://nvd.nist.gov/vuln/detail/CVE-2026-56697
NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.
Supplemental references
-
Mitigation or vendor reference
Unverified legacy reference
URL: https://github.com/nuxt/nuxt/commit/6497d99dd106254abd089f6a263d7773869a343b
[email protected] - Patch
-
Mitigation or vendor reference
Unverified legacy reference
URL: https://github.com/nuxt/nuxt/commit/e447a793c47766834f7497f8412a76cd56fd8ee1
[email protected] - Patch
-
Mitigation or vendor reference
Unverified legacy reference
URL: https://github.com/nuxt/nuxt/security/advisories/GHSA-c9cv-mq2m-ppp3
[email protected] - Third Party Advisory
-
Mitigation or vendor reference
Unverified legacy reference
URL: https://www.vulncheck.com/advisories/nuxt-open-redirect-via-protocol-relative-paths-in-reloadnuxtapp
[email protected] - Third Party Advisory
Methodology and review provenance
AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.