Is CVE-2026-114130 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-114130 being exploited in the wild.

How severe is CVE-2026-114130?

Medium severity, with a CVSS score of 4, published 21 October 2026.

Which products and versions are affected?

nuxt (npm) < 4.6.0, SEMVER:introduced=0,fixed=4.6.0; Nuxt before 4.6.0.

Is there a fix for CVE-2026-114130?

Yes. nuxt (npm): upgrade to 4.6.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-114130 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-114130?

Check whether you run nuxt (npm) or Nuxt at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-114130: Nuxt XSS via protocol bypass in NuxtLink

Q: Which products and versions are affected?

nuxt (npm) < 4.6.0, SEMVER:introduced=0,fixed=4.6.0; Nuxt before 4.6.0.

Q: Is there a fix for CVE-2026-114130?

Yes. nuxt (npm): upgrade to 4.6.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-114130 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-114130?

Check whether you run nuxt (npm) or Nuxt at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-114130 · Severity: medium · CVSS 4 · Published 2026-10-21

Nuxt is a web development framework for Vue.js applications. Prior to version 4.6.0, an incomplete security fix allows attackers to inject malicious JavaScript URLs into web pages through NuxtLink components when pages are disabled. A victim must click the crafted link for the JavaScript to execute in the attacker's origin.

Technologies: nuxt (npm), Nuxt. Vendors: npm, Nuxt.

Quick answers

Is CVE-2026-114130 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-114130 being exploited in the wild.
How severe is CVE-2026-114130?: Medium severity, with a CVSS score of 4, published 21 October 2026.
Which products and versions are affected?: nuxt (npm) < 4.6.0, SEMVER:introduced=0,fixed=4.6.0; Nuxt before 4.6.0.
Is there a fix for CVE-2026-114130?: Yes. nuxt (npm): upgrade to 4.6.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-114130 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-114130?: Check whether you run nuxt (npm) or Nuxt at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

nuxt (npm): upgrade to 4.6.0 or later
```
npm install nuxt@4.6.0
```

Technical details

The vulnerability stems from an incomplete fix for CVE-2026-53722 in the no-pages router. When attacker-controlled input to NuxtLink's `to` prop is prefixed with an ASCII C0 control character, the router classifies it as an internal route before protocol validation occurs and passes it to the anchor href. Browsers strip the leading control character, leaving a javascript: URL executable in the application's origin. The unsafe href is rendered in server-generated HTML, requiring user click for execution.

Affected products

Nuxt Nuxt before 4.6.0

Identifiers

CVE-2026-114130
GHSA-jjm6-p2m9-9w4x

Timeline

2026-10-21: disclosed
2026-10-05: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.