Threats affecting pkg:npm/nuxt/nuxt

A vulnerability in Nuxt versions from 3.0.0 up to but not including 4.6.4 allows an unauthenticated request to bypass certain route rules due to inconsistent handling of encoded slashes (%2F) in request paths. This leads to incomplete application of redirect, headers, proxy, SSR, and other route rules for decoded paths in multi-segment or catch-all routes. The issue is fixed in version 4.6.4.

A vulnerability in Nuxt versions from 3.5.0 up to but not including 4.6.4 allows unauthenticated clients to read arbitrary files from parent directories via the development server. This occurs when the development server is accessible from an untrusted network and certain parent lockfiles or settings files cause Nuxt to select a parent directory as the workspace directory. The issue affects only the development server and not production builds. It is fixed in version 4.6.4.