Skip to main content

System status

Coverage is stale.

Collection is paused. Latest public event: Aug 21, 2026 (10 days ago).

← Intel index

This coverage is stale.

Last updated May 20, 2026 (about 3 months ago).

people · May 20, 2026

Netlify Discloses Impact of Four Nuxt CVEs on Deployments

Share the canonical public link.

Share as image

Netlify published a security update on May 19, 2026 detailing four Nuxt CVEs affecting users of Nuxt 3.11.0–3.21.5 and Nuxt 4.0.0-alpha.1–4.4.5. CVE-2026-47200 allows route middleware bypass via island endpoints on affected apps; CVE-2026-46342 enables cache poisoning through unvalidated props on island responses. CVE-2026-45670 exposes source in dev servers using rspack or webpack builders with --host flag; CVE-2026-45669 permits reflected XSS via navigateTo with external: true. Netlify production deployments remain safe from CVE-2026-46342 under default Netlify-Vary caching and from CVE-2026-45670 entirely. Users should upgrade to Nuxt 3.21.6 or 4.4.6 immediately; deploy previews and branch deploys may stay vulnerable until manually deleted.

Below validation threshold — auto-passed without scoring

Supporting evidence