Sign in
Deutsch English Español Polski
Critical

nuxt Code Injection vulnerability

  • Disclosed: 13.06.2023
  • Updated: 11.10.2026 10:22

he Nuxt dev server between versions 3.4.0 and 3.4.3 is vulnerable to code injection when it is exposed publicly.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
npm package nuxt >= 3.4.0, < 3.4.3 3.4.3

References

CVSS score 8.1/10
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE)
CWE-94
Platform
npm
Package
nuxt
Disclosed
13.06.2023
Updated
11.10.2026 10:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-gc34-5v43-h7v8 - CC BY 4.0

Vulnerability history: nuxt

All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (21) in the archive
Total entries
21
First → latest
06.2023 08.2026
Without a fix
0
Exploited in attacks
0

Severity breakdown

  • Critical 2
  • High 7
  • Medium 8
  • Low 4

Disclosures per year

Severity:
  1. Nuxt: Unauthenticated CPU exhaustion parsing and hashing the Nuxt island endpoint body before hash validation
    High · 7.5 CVE-2026-71321 >= 4.0.0, < 4.5.1, >= 3.1.0, < 3.21.10 4.5.1, 3.21.10
  2. Nuxt: Server-Side Remote Code Execution via Runtime Template Injection in Nuxt Server Island Props
    High · 8.1 CVE-2026-71320 >= 4.0.0, < 4.5.1, >= 3.4.0, < 3.21.10 4.5.1, 3.21.10
  3. Nuxt runtime payload cache discloses another user's SSR data across users and to unauthenticated clients
    High · 7.5 CVE-2026-71316 >= 4.4.0, < 4.5.1 4.5.1
  4. Nuxt route rules silently dropped for mixed-case paths, bypassing appMiddleware auth gates (incomplete fix for CVE-2026-53721)
    High · 8.2 CVE-2026-71315 >= 4.4.7, < 4.5.1, >= 3.21.7, < 3.21.10 4.5.1, 3.21.10
  5. Nuxt: Unauthenticated out-of-memory crash via unbounded v-for expansion in island rendering
    High · 7.5 CVE-2026-71314 >= 4.0.0, < 4.5.1, >= 3.1.0, < 3.21.10 4.5.1, 3.21.10
  6. Nuxt: Route-rule middleware bypass via case-sensitivity mismatch between vue-router and the routeRules matcher
    High CVE-2026-53721 >= 4.0.0, < 4.4.7, >= 3.11.0, < 3.21.7 4.4.7, 3.21.7
  7. Nuxt allows DOS via cache poisoning with payload rendering response
    High · 7.5 CVE-2025-27415 >= 3.0.0, < 3.16.0 3.16.0
  8. Nuxt vulnerable to remote code execution via the browser when running the test locally
    Critical · 8.8 CVE-2024-34344 >= 3.4.0, < 3.12.4 3.12.4
  9. nuxt Code Injection vulnerability this entry
    Critical · 8.1 CVE-2023-3224 >= 3.4.0, < 3.4.3 3.4.3

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.