NU
Product
nuxt
31
CVEs
0
On KEV
9.8
Max CVSS
4
New 30D
Severity mix
Critical 1High 10Medium 18Low 2
Watch
Add nuxt to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-34344 | 8.8 | Aug 5 | Nuxt is a free and open-source framework to create full-stack web applications and websites with Vue.js Affected: 3.4.0 before 3.12.4 |
| CVE-2024-23657 | 8.8 | Aug 5 | Nuxt is a free and open-source framework to create full-stack web applications and websites with Vue.js Affected: before 1.3.9 |
| CVE-2026-71315 | 8.2 | Aug 5 | Nuxt route rules silently dropped for mixed-case paths, bypassing appMiddleware auth gates (incomplete fix for CVE-2026-53721) Affected: >= 4.4.7, < 4.5.1; >= 3.21.7, < 3.21.10 |
| CVE-2026-53721 | 8.2 | Jun 12 | Nuxt: Route-rule middleware bypass via case-sensitivity mismatch between vue-router and the routeRules matcher Affected: >= 3.11.0, < 3.21.7; >= 4.0.0, < 4.4.7 |
| CVE-2026-71320 | 8.1 | Aug 5 | Nuxt: Server-Side Remote Code Execution via Runtime Template Injection in Nuxt Server Island Props Affected: >= 4.0.0, < 4.5.1; >= 3.4.0, < 3.21.10 |
| CVE-2026-71321 | 7.5 | Aug 5 | Nuxt: Unauthenticated CPU exhaustion parsing and hashing the Nuxt island endpoint body before hash validation Affected: >= 4.0.0, < 4.5.1; >= 3.1.0, < 3.21.10 |
| CVE-2026-71316 | 7.5 | Aug 5 | Nuxt runtime payload cache discloses another user's SSR data across users and to unauthenticated clients Affected: >= 4.4.0, < 4.5.1 |
| CVE-2026-71314 | 7.5 | Aug 5 | Nuxt: Unauthenticated out-of-memory crash via unbounded v-for expansion in island rendering Affected: >= 4.0.0, < 4.5.1; >= 3.1.0, < 3.21.10 |
| CVE-2025-27415 | 7.5 | Mar 19 | Nuxt is an open-source web development framework for Vue.js Affected: 3.0.0 before 3.16.0 |
| CVE-2024-42352 | 7.5 | Aug 5 | Nuxt is a free and open-source framework to create full-stack web applications and websites with Vue.js Affected: before 1.4.5 |
Showing 10