CVE-2026-114130

Name of the Vulnerable Software and Affected Versions Nuxt versions prior to 4.6.0

Description An incomplete fix allows applications with pages disabled to render a script-capable URL through NuxtLink. This occurs when attacker-controlled input bound to the to variable is prefixed with an ASCII C0 control character. The no-pages router classifies the value as an internal route before the protocol check and passes it to the rendered anchor href. Browsers then remove the leading control character and interpret the remaining javascript: URL. The default anchor and NuxtLink custom output are affected, resulting in an unsafe href in server-rendered HTML that executes script in the application's origin when clicked by a victim.

Recommendations Update to version 4.6.0.