nuxt@3.21.6

Affected versions of this package are vulnerable to Open Redirect via the reloadNuxtApp() function. An attacker can redirect users to attacker-controlled hosts by injecting protocol-relative paths such as //evil.com, potentially enabling phishing attacks or theft of OAuth authorization codes.

Upgrade nuxt to version 3.21.7, 4.4.7 or higher.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the NoScript component when untrusted input is interpolated into its slot content. An attacker can inject malicious HTML or scripts by supplying specially crafted data that is rendered unescaped in the server-generated HTML, potentially leading to execution of arbitrary code in the user's browser.

Upgrade nuxt to version 3.21.7, 4.4.7 or higher.

Affected versions of this package are vulnerable to Incorrect Default Permissions via the module and resolve request types in the internal IPC server. An attacker can access sensitive files and secrets by connecting to the world-accessible abstract-namespace Unix socket and issuing crafted requests.

Note: This is only exploitable if the development server is running on a shared multi-tenant Linux host outside of containerized or isolated environments.

Upgrade nuxt to version 3.21.7, 4.4.7 or higher.

Affected versions of this package are vulnerable to Open Redirect via improper handling of URLs in the navigateTo function. An attacker can execute arbitrary scripts or redirect users to malicious sites by supplying crafted URLs that exploit path normalization and protocol-relative bypasses.

Upgrade nuxt to version 3.21.7, 4.4.7 or higher.

Affected versions of this package are vulnerable to Improper Handling of Case Sensitivity through the getRouteRules function in the route rules matcher. An attacker can evade prerender, SSR, or redirect rules by sending a request with a path that uses different letter casing from the configured route rule. This causes the application to serve content without applying the intended route-specific restrictions, potentially exposing pages that should be redirected or rendered differently.

Notes

• routeRules lookups are used from both the page-router plugin and the no-pages router plugin, so the mismatch can affect SSR and client-side navigations alike, rather than only one rendering path.
• The bypass is limited to deployments that rely on routeRules.appMiddleware for access control; page-level middleware declared with definePageMeta({ middleware }) is bound to the matched route record and is not part of this issue.

Workarounds

• Set router.options.sensitive = true so vue-router matches paths case-sensitively, preventing attackers from bypassing route rules by changing the case of a protected URL.

Upgrade nuxt to version 3.21.7, 4.4.7 or higher.