These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-71319 is a critical vulnerability in Nuxt DevTools that allows unauthenticated access to a bidirectional RPC channel, enabling attackers to execute arbitrary programs on a developer's machine. This vulnerability exists due to a lack of authentication in the Nuxt DevTools development mode, specifically in the Vite HMR WebSocket via the nuxt:devtools:rpc plugin. The vulnerability impacts developers [truncated]
CVE-2026-71318 is a vulnerability in the Nuxt web development framework for Vue.js, allowing an attacker to supply a top-level `as` prop to the /__nuxt_island/ endpoint to drive dynamic component resolution. This issue is fixed in versions 3.21.10 and 4.5.1. Defenders should assess exposure, especially in versions between 3.1.0 and 3.21.10 or 4.5.1, and prioritize verification and potential updates. The v [truncated]
CVE-2026-71316 debrief: Nuxt framework vulnerability discloses user SSR data due to improper enforcement of import.meta.prerender, affecting versions from 4.4.0 to 4.5.1. This high-severity issue allows disclosure of user SSR data. Defenders and developers using affected versions should assess exposure and upgrade to version 4.5.1 or later to prevent potential data disclosure. The vulnerability impacts us [truncated]
CVE-2026-71315 is a high-severity vulnerability in the Nuxt web development framework for Vue.js. The issue arises from mixed-case routeRules keys that can fail to match case-folded lookups when router.options.sensitive is false, potentially dropping appMiddleware authorization gates. This problem is a result of an incomplete fix for CVE-2026-53721. The vulnerability is fixed in Nuxt versions 3.21.10 and 4.5.1.
CVE-2026-71314 is a high-severity vulnerability in the Nuxt framework that can lead to a denial-of-service (DoS) condition. An unauthenticated attacker can exploit this vulnerability by using a server island v-for prop to trigger unbounded SSR memory allocation, causing the Nuxt process to crash. This issue affects Nuxt versions from 3.1.0 until 3.21.10 and 4.5.1. Defenders should assess exposure and prio [truncated]
CVE-2026-56698 is a medium-severity vulnerability in Nuxt versions 4.0.0 before 4.4.7 and 3.x before 3.21.7. The vulnerability allows client-side script execution via the open parameter in the navigateTo function. Attackers can supply javascript: URLs to execute arbitrary scripts in the application's origin. This vulnerability was published on June 22, 2026, and modified on June 25, 2026. The CVSS score i [truncated]
CVE-2026-56697 is a medium-severity vulnerability in Nuxt versions 4.0.0 before 4.4.7 and 3.x before 3.21.7. The vulnerability allows attackers to inject protocol-relative paths, such as //evil.com, into the reloadNuxtApp function. This can lead to cross-origin URL resolution against the current page protocol, enabling phishing and OAuth authorization-code theft. The vulnerability has a CVSS score of 5.3 [truncated]
CVE-2026-56326 is a server-side open redirect vulnerability in Nuxt, a popular JavaScript framework for building web applications. The vulnerability affects Nuxt versions 4.0.0 before 4.4.7 and 3.x before 3.21.7. An attacker can exploit this vulnerability by using path-normalization techniques to bypass external-host checks, redirecting users to attacker-controlled sites via the Location header or meta-re [truncated]
CVE-2026-53722 is a reflected DOM-based cross-site scripting vulnerability in the Nuxt open-source web development framework for Vue.js. Prior to versions 3.21.7 and 4.4.7, the <NuxtLink> component did not validate the URL scheme of values bound to its to or href props before rendering them into the href attribute of the underlying <a> element. This allows an attacker to supply a javascript: or vbscript: [truncated]
CVE-2026-53721 is a HIGH severity vulnerability in Nuxt, a Vue.js web development framework. Versions 3.11.0 to before 3.21.7 and 4.0.0 to before 4.4.7 are affected by a route-rule middleware bypass due to a case-sensitivity mismatch between vue-router and the routeRules matcher. This vulnerability was patched in versions 3.21.7 and 4.4.7.
CVE-2026-49993 is a MEDIUM severity vulnerability in @nuxt/rspack-builder and @nuxt/webpack-builder. An incomplete fix for GHSA-6m52-m754-pw2g allows source code to be stolen during development when the dev server is bound to a non-loopback address and a malicious site is opened on the same network.
CVE-2026-47200 is a vulnerability in Nuxt, an open-source web development framework for Vue.js. Versions 3.11.0 to before 3.21.6 and 4.0.0-alpha.1 to before 4.4.6, when experimental.componentIslands is enabled (default in Nuxt 4), any .server.vue file under pages/ is automatically registered as a server island under the key page_<routeName> and exposed via the /__nuxt_island/:name endpoint. Until this fix [truncated]
CVE-2026-46342 is a vulnerability in Nuxt, an open-source web development framework for Vue.js. The vulnerability affects Nuxt versions 3.1.0 to before 3.21.6 and 4.0.0-alpha.1 to before 4.4.6, as well as @nuxt/nitro-server versions 3.20.0 to before 3.21.6 and 4.0.0-alpha.1 to before 4.4.6. The /__nuxt_island/* endpoint accepts attacker-controlled props query/body parameters and renders any island compone [truncated]
A vulnerability was found in @nuxt/rspack-builder and @nuxt/webpack-builder versions 3.15.4 to before 3.21.6, and 4.0.0-alpha.1 to before 4.4.6. This issue is an incomplete fix for GHSA-4gf7-ff8x-hq99. Source code may be stolen during development when using the webpack / rspack builder if the development server is bound to a non-loopback address (e.g., `nuxt dev --host`) and the developer opens a maliciou [truncated]
CVE-2026-45669 is a vulnerability in the Nuxt open-source web development framework for Vue.js. Versions 3.4.3 to before 3.21.6 and 4.0.0-alpha.1 to before 4.4.6 are affected. The navigateTo() function with external: true generates a server-side HTML redirect body containing a <meta http-equiv='refresh'> tag. The destination URL is only sanitized by replacing ' with %22, leaving <, >, &, and ' unencoded. [truncated]