Conoce las vulnerabilidades. Protege tus aplicaciones.

Media 15.10.2026

CVE-2026-102527

Envenenamiento de caché en Nuxt OG Image mediante claves de caché derivables en rutas de imágenes dinámicas no firmadas

Una vulnerabilidad de envenenamiento de caché en Nuxt OG Image permite a atacantes no autenticados modificar el contenido de las imágenes entregadas a los usuarios debido a claves de caché derivables en rutas de imágenes dinámicas.

npm

nuxt-og-image

Alta 01.10.2026

CVE-2026-92708

devalue: `stringify`/`uneval` serialize shared memory

npm

devalue

Media 17.09.2026

CVE-2026-61793

Nuxt OG Image has unauthenticated SSRF via `fonts[].path` URL parameter

npm

nuxt-og-image

Alta 16.09.2026

CVE-2026-63671

@nuxtjs/mdc's URL sanitizer misses SVG xlink:href and data:text/html, allowing XSS from untrusted markdown at the default configuration

npm

@nuxtjs/mdc

Alta 09.09.2026

CVE-2026-59158

Nuxt Ollama: Public Runtime Config Exposes Ollama API Key to Browser Clients

npm

nuxt-ollama

Media 07.08.2026

CVE-2026-72744

Nuxt dev server discloses project root and workspace UUID via the Chrome DevTools workspace endpoint

npm

nuxt

Alta 05.08.2026

CVE-2026-71321

Nuxt: Unauthenticated CPU exhaustion parsing and hashing the Nuxt island endpoint body before hash validation

npm

nuxt

Alta 05.08.2026

CVE-2026-71320

Nuxt: Server-Side Remote Code Execution via Runtime Template Injection in Nuxt Server Island Props

npm

nuxt

Crítica 05.08.2026

CVE-2026-71319

Unauthenticated Nuxt DevTools RPC allows arbitrary command execution on the developer's host

npm

@nuxt/devtools

Media 05.08.2026

CVE-2026-71318

Nuxt: Unauthorized Component Instantiation via Server Island Props

npm

nuxt

Alta 05.08.2026

CVE-2026-71316

Nuxt runtime payload cache discloses another user's SSR data across users and to unauthenticated clients

npm

nuxt

Alta 05.08.2026

CVE-2026-71315

Nuxt route rules silently dropped for mixed-case paths, bypassing appMiddleware auth gates (incomplete fix for CVE-2026-53721)

npm

nuxt

Alta 05.08.2026

CVE-2026-71314

Nuxt: Unauthenticated out-of-memory crash via unbounded v-for expansion in island rendering

npm

nuxt

Media 02.07.2026

ghsa-gj2h-2fpw-fhv9

@nuxt/ui: UAuthForm / UForm SSR markup omits `method`, leaking credentials via GET if submitted before hydration

npm

@nuxt/ui

Media 16.06.2026

CVE-2026-49993

@nuxt/webpack-builder and @nuxt/rspack-builder dev server same-origin check bypassed when Sec-Fetch-Site, Origin, and Referer are all absent (incomplete fix for GHSA-6m52-m754-pw2g)

npm

@nuxt/rspack-builder, @nuxt/webpack-builder

Baja 16.06.2026

CVE-2026-56317

Cross-site scripting via <NoScript> slot content in Nuxt's head components

npm

nuxt

Media 16.06.2026

CVE-2026-53722

Nuxt: Reflected XSS in `<NuxtLink>` via unsanitised `javascript:` or `data:` URL

npm

nuxt

Media 16.06.2026

CVE-2026-56301

Nuxt dev server vite-node IPC socket is world-connectable on Linux

npm

nuxt

Alta 16.06.2026

CVE-2026-53721

Nuxt: Route-rule middleware bypass via case-sensitivity mismatch between vue-router and the routeRules matcher

npm

nuxt

Media 16.06.2026

CVE-2026-56326

Nuxt: URL-handling weaknesses in `navigateTo` and `reloadNuxtApp`: SSR open redirect, client-side script execution via the `open` option, and protocol-relative bypass in `reloadNuxtApp`

npm

nuxt

Baja 15.06.2026

ghsa-rq7w-g337-39qq

Nuxt: Dev server discloses project absolute path and persistent workspace UUID via `/.well-known/appspecific/com.chrome.devtools.json`

npm

nuxt

Media 29.05.2026

CVE-2026-47200

Nuxt's route middleware is not enforced when rendering `.server.vue` pages via `/__nuxt_island/page_*`

npm

nuxt, @nuxt/nitro-server

Baja 19.05.2026

CVE-2026-46342

Nuxt: `__nuxt_island` endpoint does not bind responses to request props, enabling shared-cache poisoning

npm

nuxt, @nuxt/nitro-server

Media 19.05.2026

CVE-2026-45670

Nuxt: Dev server exposes built source over LAN to malicious sites (incomplete fix for GHSA-4gf7-ff8x-hq99)

npm

@nuxt/rspack-builder, @nuxt/webpack-builder