Nuxt Releases Security Patches for Critical Vulnerabilities

On July 27, 2026, Nuxt released version updates 4.5.1 and 3.21.10 to address several security vulnerabilities, including a high-severity server-side remote code execution risk. The vulnerabilities primarily affect applications using Vue's runtime compiler and server components under specific conditions. Users are urged to upgrade immediately, especially if they utilize route rules with uppercase characters, which could lead to unauthorized access. Other issues include potential denial-of-service vulnerabilities and risks of serving cached user-specific data to unauthorized users. The Nuxt team has provided advisories detailing the vulnerabilities and recommended actions for affected users. The vulnerabilities are not limited to any specific hosting provider, impacting all Nuxt applications. Users should also refresh their lockfiles to include critical updates for development tools.

Key Points: • Nuxt 4.5.1 and 3.21.10 released to address critical vulnerabilities. • Server-side remote code execution risk exists under specific conditions. • Immediate upgrade is recommended for all Nuxt applications.