StackPrism

npm package

nuxt vulnerabilities by version

The latest release, 4.6.2 (Oct 16, 2026), has no known vulnerabilities. 43% of last week’s 2.3M downloads went to versions with known vulnerabilities. OSV.dev lists 21 advisories for nuxt; the newest was published on Aug 7, 2026.

npm (opens in a new tab) describes it as “Nuxt is a free and open-source framework with an intuitive and extendable way to create type-safe, performant and production-grade full-stack web applications and websites with Vue.js.”

Latest release
4.6.2
Oct 16, 2026, no known vulnerabilities
Downloads last week
2.3M
All versions, from npm
Advisories on OSV.dev
21
Newest Aug 7, 2026
Licence
MIT
OpenSSF Scorecard
7/10
nuxt/nuxt (opens in a new tab)

Most-downloaded versions last week

From npm’s per-version download counts for the last 7 days, each checked against OSV.dev. Open a version for its advisories and what to upgrade to.

VersionKnown vulnerabilitiesDownloads
4.5.2Aug 5, 2026No known vulnerabilities729.6K
4.6.0Oct 5, 2026No known vulnerabilities191.7K
3.21.11Aug 5, 2026End of lifeNo known vulnerabilities164K
4.4.8Jun 8, 20267 known vulnerabilities, worst rated critical148.3K
4.5.1Jul 27, 2026No known vulnerabilities134.2K
4.6.1Oct 9, 2026No known vulnerabilities69.9K
4.3.1Feb 7, 202613 known vulnerabilities, worst rated critical68.4K
4.4.2Mar 12, 202614 known vulnerabilities, worst rated critical64K

Who is still on a vulnerable nuxt

43% of last week’s 2.3M nuxt downloads went to versions with known vulnerabilities.

From npm’s per-version download counts for the last 7 days, each version checked against OSV.dev. The versions checked cover over 99% of downloads.

Release lines

Support dates from endoflife.date (opens in a new tab). A line past its end date gets no more security fixes.

LineLatestSecurity support
44.6.2No end date announced
33.21.11Ended Jul 31, 2026
22.18.1Ended Jun 30, 2024
11.4.5Ended Sep 21, 2019

Newest advisories

The 5 most recently published, with the versions each one affects.

  1. WarningCVE-2026-72744 on OSV.dev (opens in a new tab)GHSA-7c4v-fwgw-9rf7

    Nuxt dev server discloses project root and workspace UUID via the Chrome DevTools workspace endpoint

    Affects >= 4.4.7, < 4.5.1; >= 3.21.7, < 3.21.10. Published Aug 7, 2026.

  2. CriticalCVE-2026-71321 on OSV.dev (opens in a new tab)GHSA-9pgf-384g-p7mv

    Nuxt: Unauthenticated CPU exhaustion parsing and hashing the Nuxt island endpoint body before hash validation

    Affects >= 4.0.0, < 4.5.1; >= 3.1.0, < 3.21.10. Published Aug 5, 2026.

  3. CriticalCVE-2026-71320 on OSV.dev (opens in a new tab)GHSA-9473-5f9j-94wq

    Nuxt: Server-Side Remote Code Execution via Runtime Template Injection in Nuxt Server Island Props

    Affects >= 4.0.0, < 4.5.1; >= 3.4.0, < 3.21.10. Published Aug 5, 2026.

  4. WarningCVE-2026-71318 on OSV.dev (opens in a new tab)GHSA-48hr-524c-v5w3

    Nuxt: Unauthorized Component Instantiation via Server Island Props

    Affects >= 4.0.0, < 4.5.1; >= 3.1.0, < 3.21.10. Published Aug 5, 2026.

  5. CriticalCVE-2026-71316 on OSV.dev (opens in a new tab)GHSA-wm8w-6qjm-cv43

    Nuxt runtime payload cache discloses another user's SSR data across users and to unauthenticated clients

    Affects >= 4.4.0, < 4.5.1. Published Aug 5, 2026.

All 21 advisories are on OSV.dev (opens in a new tab).

Which nuxt do you have?

Paste a public GitHub repo or drop your package.json and see every vulnerable, end-of-life or deprecated dependency, with one fix task for your coding agent. Free, no sign-up.

Check your whole repo

How this page is checked

StackPrism reads every OSV.dev advisory for nuxt, merges duplicates filed under several ids, and asks OSV.dev which ones affect each version listed. Releases and their dates come from deps.dev, downloads from npm, support dates from endoflife.date. No AI writes this page: every sentence comes from that data, refreshed every few hours.

Last checked against OSV.dev, CISA KEV, npm, deps.dev and endoflife.date.