CVE-2026-56697

Name of the Vulnerable Software and Affected Versions Nuxt versions 3.x prior to 3.21.7 Nuxt versions 4.0.0 through 4.4.6

Description The reloadNuxtApp() function accepts protocol-relative paths, such as //evil.com. These paths bypass the script-protocol check and resolve to a cross-origin URL based on the current page protocol. This allows attackers to inject paths that redirect users to attacker-controlled hosts, which can be used for phishing and the theft of OAuth authorization codes.

Recommendations Update Nuxt versions 3.x to 3.21.7. Update Nuxt versions 4.x to 4.4.7. As a temporary workaround, restrict the use of the reloadNuxtApp() function until the updates are applied.