This advisory details three related vulnerabilities in Nuxt's navigation functions. CVE-2026-56326 is an SSR open redirect caused by path-normalisation bypass in `navigateTo`, where certain crafted paths starting with '/' normalize to protocol-relative URLs, enabling cross-origin redirects. CVE-2026-56698 allows client-side script execution via `navigateTo({ open: ... })` because the early-open handler does not check for script protocols, enabling reflected XSS with javascript: URLs. CVE-2026-56697 is an open redirect in `reloadNuxtApp` via protocol-relative URL bypass, where URLs like `//evil.com` resolve to the current protocol and bypass script protocol checks, causing cross-origin redirects. These issues affect Nuxt versions >=3.5.0 <3.21.7 and >=4.0.0 <4.4.7 and have been fixed in 3.21.7 and 4.4.7 respectively.

The SSR open redirect (CVE-2026-56326) can be exploited for phishing or OAuth code theft in Nuxt apps that pass user-controlled input to `navigateTo` on the server, undermining the framework's external host blocking. The client-side script execution (CVE-2026-56698) enables reflected XSS in the application's origin if untrusted URLs are passed to `navigateTo` with the `open` option. The open redirect in `reloadNuxtApp` (CVE-2026-56697) allows cross-origin redirects even in versions with script protocol guards, risking phishing and token theft. No known exploits in the wild have been reported.

A fix is available in [email protected] and [email protected] that addresses all three vulnerabilities. Users should upgrade to these versions or later. As a workaround, validate and sanitize redirect targets before passing them to `navigateTo` or `reloadNuxtApp`: reject paths starting with `//` or those that resolve to external hosts. For `navigateTo({ open })`, restrict allowed protocols to safe schemes like http and https. These mitigations reduce risk until patched versions are deployed.