PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-56697 Nuxt CVE debrief

CVE-2026-56697 is a medium-severity vulnerability in Nuxt versions 4.0.0 before 4.4.7 and 3.x before 3.21.7. The vulnerability allows attackers to inject protocol-relative paths, such as //evil.com, into the reloadNuxtApp function. This can lead to cross-origin URL resolution against the current page protocol, enabling phishing and OAuth authorization-code theft. The vulnerability has a CVSS score of 5.3 and is classified as MEDIUM. The CVE was published on 2026-06-22T22:16:52.650Z and last modified on 2026-06-25T16:55:20.860Z.

Vendor
Nuxt
Product
Unknown
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-22
Original CVE updated
2026-06-25
Advisory published
2026-06-22
Advisory updated
2026-06-25

Who should care

Developers and administrators using Nuxt versions 4.0.0 before 4.4.7 and 3.x before 3.21.7 should be aware of this vulnerability. Attackers can exploit this vulnerability to redirect users to malicious sites, potentially leading to phishing and OAuth authorization-code theft. Users of affected versions should prioritize patching to prevent potential attacks.

Technical summary

The vulnerability in Nuxt arises from the acceptance of protocol-relative paths, such as //evil.com, in the reloadNuxtApp function. These paths pass the script-protocol check but resolve to a cross-origin URL against the current page protocol. This allows attackers to inject paths like //evil.com to redirect users to attacker-controlled hosts. The vulnerability is classified under CWE-601, indicating a URL Redirection to Untrusted Site ('Open Redirect').

Defensive priority

Patching to the latest version of Nuxt is highly recommended. Developers should update to version 4.4.7 or later for 4.x versions and 3.21.7 or later for 3.x versions.

Recommended defensive actions

  • Patch to the latest version of Nuxt.
  • Review and update affected Nuxt applications.
  • Monitor for suspicious redirect activity.
  • Implement additional security measures for OAuth authorization flows.
  • Educate users about phishing risks.

Evidence notes

The CVE-2026-56697 vulnerability was published in the NVD database and has a CVSS score of 5.3. The vulnerability affects Nuxt versions 4.0.0 before 4.4.7 and 3.x before 3.21.7. Limited information is available about the specific exploits or attacks in the wild.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-56697 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-56697

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-56697 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-56697

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.