Skip to content
Noroxi

nuxt records

25 published records for vendor nuxt.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
4
With a fix record
88%
Median publish → KEV
No record has entered KEV

Records by year

  1. 22
  2. 23
  3. 24
  4. 25
  5. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

25 records
  • CVE-2023-3224
    57Plan

    Code Injection in nuxt/nuxt

    CriticalCVSS 9.8No exploitEPSS 59%

    nuxt · nuxtJun 13, 2023

  • CVE-2024-23657
    35Monitor

    Path Traversal: '../filedir' in Nuxt Devtools

    HighCVSS 8.8No exploitEPSS 1%

    nuxt · nuxtAug 5, 2024

  • CVE-2024-34344
    35Monitor

    Remote code execution via the browser when running the test locally in nuxt

    HighCVSS 8.8No exploitEPSS 1%

    nuxt · nuxtAug 5, 2024

  • CVE-2026-53721
    35Monitor

    Nuxt: Route-rule middleware bypass via case-sensitivity mismatch between vue-router and the routeRules matcher

    HighCVSS 8.8No exploitEPSS 1%

    nuxt · nuxtJun 12, 2026

  • CVE-2024-42352
    30Monitor

    Server-Side Request Forgery (SSRF) in nuxt-icon

    HighCVSS 7.5No exploitEPSS 1%

    nuxt · nuxtAug 5, 2024

  • CVE-2025-27415
    30Monitor

    Nuxt allows DOS via cache poisoning with payload rendering response

    HighCVSS 7.5Proof of conceptEPSS 0%

    nuxt · nuxtMar 19, 2025

  • CVE-2026-34404
    27Monitor

    Nuxt OG Image vulnerable to DoS via image generation

    MediumCVSS 6.9No exploitEPSS 0%

    nuxt · og imageMar 31, 2026

  • CVE-2026-56301
    27Monitor

    Nuxt - Arbitrary File Read via World-Connectable vite-node IPC Socket on Linux

    MediumCVSS 6.8No exploitEPSS 0%

    nuxt · nuxtJun 23, 2026

  • CVE-2026-47200
    25Monitor

    Nuxt: Route middleware not enforced when rendering `.server.vue` pages via `/__nuxt_island/page_*`

    MediumCVSS 6.3No exploitEPSS 0%

    nuxt · nuxtJun 12, 2026

  • CVE-2023-0878
    24Monitor

    Cross-site Scripting (XSS) - Generic in nuxt/framework

    MediumCVSS 6.1No exploitEPSS 1%

    nuxt · nuxtFeb 16, 2023

  • CVE-2022-4413
    24Monitor

    Cross-site Scripting (XSS) - Reflected in nuxt/framework

    MediumCVSS 6.1No exploitEPSS 1%

    nuxt · frameworkDec 11, 2022

  • CVE-2022-4414
    24Monitor

    Cross-site Scripting (XSS) - DOM in nuxt/framework

    MediumCVSS 6.1No exploitEPSS 0%

    nuxt · frameworkDec 11, 2022

  • CVE-2024-34343
    24Monitor

    Cross-site Scripting (XSS) in navigateTo if used after SSR in nuxt

    MediumCVSS 6.1No exploitEPSS 0%

    nuxt · nuxtAug 5, 2024

  • CVE-2026-34405
    24Monitor

    Nuxt OG Image vulnerable to reflected XSS via query parameter injection into HTML attributes

    MediumCVSS 6.1No exploitEPSS 0%

    nuxt · og imageMar 31, 2026

  • CVE-2025-52662
    24Monitor

    A vulnerability in Nuxt DevTools has been fixed in version **2.6.4***.

    MediumCVSS 6.1No exploitEPSS 0%

    nuxt · devtoolsNov 6, 2025

  • CVE-2026-45670
    23Monitor

    Nuxt: Dev server exposes built source over LAN to malicious sites (incomplete fix for GHSA-4gf7-ff8x-hq99)

    MediumCVSS 5.9No exploitEPSS 0%

    nuxt · nuxt\/rspack-builderJun 12, 2026

  • CVE-2026-49993
    23Monitor

    @nuxt/webpack-builder and @nuxt/rspack-builder dev server same-origin check bypassed when Sec-Fetch-Site, Origin, and Referer are all absent (incomplete fix for

    MediumCVSS 5.9No exploitEPSS 0%

    nuxt · nuxt\/rspack-builderJun 12, 2026

  • CVE-2026-56698
    21Monitor

    Nuxt - Cross-Site Scripting via navigateTo open Option

    MediumCVSS 5.3No exploitEPSS 0%

    nuxt · nuxtJun 22, 2026

  • CVE-2026-56326
    21Monitor

    Nuxt - Server-Side Open Redirect via Path-Normalization Bypass in navigateTo

    MediumCVSS 5.3No exploitEPSS 0%

    nuxt · nuxtJun 22, 2026

  • CVE-2026-56697
    21Monitor

    Nuxt - Open Redirect via Protocol-Relative Paths in reloadNuxtApp

    MediumCVSS 5.3No exploitEPSS 0%

    nuxt · nuxtJun 22, 2026

  • CVE-2026-45669
    21Monitor

    Nuxt: Reflected XSS in `navigateTo()` external redirect

    MediumCVSS 5.3No exploitEPSS 0%

    nuxt · nuxtJun 12, 2026

  • CVE-2026-53722
    20Monitor

    Nuxt: Reflected XSS in `<NuxtLink>` via unsanitised `javascript:` or `data:` URL

    MediumCVSS 5.1No exploitEPSS 0%

    nuxt · nuxtJun 12, 2026

  • CVE-2025-59414
    12Monitor

    Nuxt Client-Side Path Traversal in Nuxt Island Payload Revival

    LowCVSS 3.1No exploitEPSS 0%

    nuxt · nuxtSep 17, 2025

  • CVE-2026-56317
    9Monitor

    Nuxt - Cross-Site Scripting via NoScript Component Slot Content

    LowCVSS 2.3No exploitEPSS 0%

    nuxt · nuxtJun 20, 2026

  • CVE-2026-46342
    9Monitor

    Nuxt: `__nuxt_island` endpoint does not bind responses to request props, enabling shared-cache poisoning

    LowCVSS 2.3No exploitEPSS 0%

    nuxt · nuxtJun 12, 2026