Nuxt July 2026 security advisory
By Steven Van ·
Nuxt 4.5.1 and 3.21.10 patch eight vulnerabilities, including a high-severity RCE that Vercel had already blocked with WAF rules before disclosure.
Nuxt has shipped 4.5.1 and 3.21.10, security patch releases for the 4.x and 3.x lines, along with @nuxt/devtools 3.3.1. Together they fix eight advisories, the most serious a high-severity server-side remote code execution flaw in server island props.
- Server-side remote code execution via server island props (High, GHSA-9473-5f9j-94wq)
- Unauthorized component instantiation via server island props (Medium, GHSA-48hr-524c-v5w3)
- Route rule authorization bypass (High, GHSA-hxvh-4h3w-prp9)
- Server component denial of service (High, GHSA-hxcr-hm88-mpq6, GHSA-9pgf-384g-p7mv)
- Cross-user disclosure of cached payloads on Nuxt 4.x from 4.4.0 onward (High, GHSA-wm8w-6qjm-cv43)
- Development server path disclosure (Low, GHSA-7c4v-fwgw-9rf7)
- Remote code execution in Nuxt DevTools, development-only, fixed in @nuxt/devtools 3.3.1 (Critical, GHSA-279x-mwfv-vcqv)
Vercel received advance notice of the server-side RCE advisory and deployed platform-wide WAF mitigations before the public disclosure, so apps deployed on Vercel are automatically covered for that specific issue with no configuration changes required. Vercel notes the mitigations aren't a substitute for upgrading: they only block direct exploitation of the RCE, while the component instantiation, caching, authorization, denial-of-service and DevTools issues still require the Nuxt and DevTools updates. Anyone who already patched the earlier route rule advisory, CVE-2026-53721, still needs this release, since the new authorization bypass is a regression in that fix. Full details are in the Nuxt security advisory.
