CVE-2026-56326

Name of the Vulnerable Software and Affected Versions Nuxt versions prior to 4.4.7 Nuxt versions prior to 3.21.7

Description Nuxt contains three security issues related to client-navigation URL handling via the navigateTo() and reloadNuxtApp() functions. First, a server-side open redirect exists in navigateTo() where path-normalization bypasses, such as using /..//evil.com or /.//evil.com, allow attackers to circumvent external-host checks. This results in the browser resolving the redirect to an attacker-controlled host via the Location header or meta-refresh, potentially enabling phishing and OAuth authorization-code theft.

Second, a client-side script execution issue exists in navigateTo() when the open option is used. The handler fails to apply script-protocol checks, allowing targets like javascript:... to execute in the application's origin, leading to reflected Cross-Site Scripting (XSS), which is the execution of malicious scripts in a victim's browser.

Third, an open redirect exists in reloadNuxtApp() via the path variable. Protocol-relative paths like //evil.com bypass protocol checks and are assigned to window.location.href, causing a cross-origin redirect.

Recommendations Update to version 4.4.7 or later. Update to version 3.21.7 or later. As a temporary mitigation for open redirects, validate redirect targets before passing them to navigateTo() or reloadNuxtApp({ path }) by rejecting any input where the pathname starts with // or by using a known allow-list of paths. As a temporary mitigation for script execution, reject any user-controlled URL whose protocol is not in an allow-list (such as http: and https:) before passing it to navigateTo({ open: ... }).