Homepage

nuxt@4.6.2

Nuxt is a free and open-source framework with an intuitive and extendable way to create type-safe, performant and production-grade full-stack web applications and websites with Vue.js.

  • latest version

    4.6.4

  • latest non vulnerable version

    4.6.4

  • first published

    10 years ago

  • latest version published

    1 days ago

  • licenses detected

  • View nuxt package health on Snyk  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the nuxt package. This does not include vulnerabilities belonging to this package’s dependencies.

    Fix vulnerabilities automatically

    Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

    Fix for free
    VulnerabilityVulnerable Version
    • M
    Incorrect Authorization

    Affected versions of this package are vulnerable to Incorrect Authorization via dot segment handling in toRequestEvent in packages/nitro-server/src/runtime/utils/event.ts. An attacker can send a request containing . or .. path segments (including their percent-encoded forms such as %2e) to cause the server-side router to resolve the path to a different route than the one named by event.path, potentially bypassing server middleware path checks and accessing unintended pages or resources.

    Note: Path checks in server middleware should also account for the page router matching paths case-insensitively unless router.options.sensitive is set.

    How to fix Incorrect Authorization?

    Upgrade nuxt to version 4.6.3 or higher.

    >=4.6.0 <4.6.3
    Go back to all versions of this package