Nuxt security vulnerabilities: what Netlify users need to know

The Nuxt team has disclosed several security vulnerabilities fixed in Nuxt 4.5.1 and 3.21.10, ranging from a high-severity server-side remote code execution (under specific conditions) to lower-severity and development-only issues. Here’s what Netlify customers need to know.

This issue only applies under uncommon conditions : it requires Vue’s runtime compiler ( vue.runtimeCompiler: true , which is off by default) and a server island that forwards untrusted input into a component. Few applications meet both conditions, so real-world exposure is limited. We’ve proactively reached out to the very small number of Netlify customers whose projects could potentially be affected.

This is a framework-level issue that affects Nuxt apps regardless of hosting provider . It is not specific to Netlify. You’re affected if you use routeRules with appMiddleware as an authorization gate and any rule key contains an uppercase character , such as a rule derived from a page like pages/Admin.vue or written explicitly as routeRules: { '/Admin': ... } . Because routing is case-insensitive by default, the page was served while its route rule (and the middleware guarding it) was silently skipped. This is a regression in the earlier fix for CVE-2026-53721 , so upgrading only to 4.4.7 or 3.21.7 does not protect you. Upgrade to Nuxt 4.5.1 or 3.21.10, then audit any uppercase route rule keys used for access control.

These are server-side denial-of-service (DoS) vulnerabilities. On Netlify, these have minimal impact : our autoscaling serverless architecture means that a malicious request resulting in a crashed or hung function does not affect other requests. However, active exploitation could increase your function costs.

If you use the cache , swr , or isr route rules on authenticated pages that render user-specific data, a cached payload could be served to the wrong user. After upgrading, purge any upstream CDN cache (e.g. Akamai or Cloudflare) that may already be holding a leaked payload. Upgrading alone won’t evict it.

The Nuxt DevTools remote code execution and the dev server path disclosure only affect local development , not deployed Netlify sites. Still, refresh your lockfile so it picks up @nuxt/[email protected] .

We strongly recommend upgrading as soon as possible to a patched release:

Running npx nuxt upgrade --dedupe also refreshes your lockfile so it pulls in @nuxt/[email protected] , which fixes the critical development-only issue above.

Note that any publicly available deploy previews and branch deploys may remain vulnerable until they are automatically deleted . Consider deleting these deploys manually .