Threats affecting pkg:npm/@nuxt/nitro-server

CVE-2026-128076 is a low-severity vulnerability in the @nuxt nitro-server framework affecting versions from 3.21.6 up to but not including 4.0.0 and from 4.4.6 up to but not including 4.6.4. It involves improper encoding or escaping of output in the /__nuxt_island path hash, which uses ohash serialization that does not escape quotes in string values or delimiters in object keys. This flaw allows different island-prop tuples to produce the same path, potentially leading to content substitution or script execution if unsafe HTML sinks like v-html or innerHTML are used. The issue is fixed in version 4.6.4.

A vulnerability in Nuxt versions from 3.0.0 up to but not including 4.6.4 allows an unauthenticated request to bypass certain route rules due to inconsistent handling of encoded slashes (%2F) in request paths. This leads to incomplete application of redirect, headers, proxy, SSR, and other route rules for decoded paths in multi-segment or catch-all routes. The issue is fixed in version 4.6.4.

A path normalization vulnerability in Nuxt versions 4.6.0 through 4.6.2 allows bypassing server-side middleware and route rules by using dot segments ('.' and '..') or their percent-encoded forms in request paths. This causes the page router to resolve these segments before rendering, while server-side checks see the unnormalized path, enabling unauthorized access to protected pages. The issue is fixed in Nuxt 4.6.3, which returns 404 for such paths and normalizes route rule keys accordingly.