Frontend framework
Nuxt: supported versions and open vulnerabilities today
Nuxt 4 is supported; 3 reached end of life on Jul 31, 2026; the latest release is 4.6.2. 6 high or critical advisories for Nuxt were published in the last 12 months; none of its advisories is on CISA’s list of exploited vulnerabilities.
Last checked against endoflife.date, npm, OSV.dev, CISA KEV, FIRST EPSS and deps.dev.
- Latest release
- 4.6.2
- npm downloads last week
- 2.3M
- GitHub stars
- 61k
- Licence
- MIT
- OpenSSF Scorecard
- 7 / 10
Supported versions
Security advisories
16 advisories published in the last 12 months, 6 of them high or critical. 21 in total since records began. Checked packages: nuxt.
Nuxt: Server-Side Remote Code Execution via Runtime Template Injection in Nuxt Server Island Props
Fixed in 3.21.10 and 4.5.1.
EPSS: top 48%Nuxt: Unauthenticated CPU exhaustion parsing and hashing the Nuxt island endpoint body before hash validation
Fixed in 3.21.10 and 4.5.1.
EPSS: top 47%Nuxt: Unauthenticated out-of-memory crash via unbounded v-for expansion in island rendering
Fixed in 3.21.10 and 4.5.1.
EPSS: top 50%Nuxt route rules silently dropped for mixed-case paths, bypassing appMiddleware auth gates (incomplete fix for CVE-2026-53721)
Fixed in 3.21.10 and 4.5.1.
EPSS: top 62%Nuxt runtime payload cache discloses another user's SSR data across users and to unauthenticated clients
Fixed in 4.5.1.
EPSS: top 59%Nuxt: Route-rule middleware bypass via case-sensitivity mismatch between vue-router and the routeRules matcher
Fixed in 3.21.7 and 4.4.7.
EPSS: top 58%
Maintenance and supply chain
OpenSSF Scorecard 7 / 10 (scored )
The Scorecard rates the repository’s security practices, not known vulnerabilities. Recent activity: 30 commits and 11 issue updates found in the last 90 days.
Weakest checks
- No branch protection (Branch-Protection 0/10)
- No fuzzing (Fuzzing 0/10)
- Little code review (Code-Review 2/10)
Alternatives
Next.js
React framework for production
Strengths
- Server-side rendering
- API routes included
Trade-offs
- React-only
- Opinionated structure
Docs and release notes
Check Nuxt in your own stack
This page checks Nuxt in general. Your repo pins specific versions: the free dependency check reads your manifests and lists what to fix first. Prism Agent runs the same live checks on your whole stack and turns them into a plan your coding agent can build.