Is CVE-2026-45669 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-45669 being exploited in the wild.

How severe is CVE-2026-45669?

Medium severity, with a CVSS score of 3.1, published 12 June 2026.

Which products and versions are affected?

nuxt (npm) SEMVER:introduced=3.4.3,fixed=3.21.6.

Is there a fix for CVE-2026-45669?

Yes. nuxt (npm): upgrade to 3.21.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-45669 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-45669?

Check whether you run nuxt (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-45669: Nuxt reflected XSS in navigateTo external redirect

CVE-2026-45669 · Severity: medium · CVSS 3.1 · Published 2026-06-12

Nuxt is a popular web development framework used to build high-performance websites. A security flaw in its redirection system allows attackers to perform 'Cross-Site Scripting' (XSS) attacks. By tricking a user into clicking a malicious link, an attacker could execute unauthorized code in the user's browser, potentially leading to the theft of login session data or unauthorized actions on the user's behalf.

Technologies: nuxt (npm). Vendors: npm.

Quick answers

Is CVE-2026-45669 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-45669 being exploited in the wild.
How severe is CVE-2026-45669?: Medium severity, with a CVSS score of 3.1, published 12 June 2026.
Which products and versions are affected?: nuxt (npm) SEMVER:introduced=3.4.3,fixed=3.21.6.
Is there a fix for CVE-2026-45669?: Yes. nuxt (npm): upgrade to 3.21.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-45669 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-45669?: Check whether you run nuxt (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

nuxt (npm): upgrade to 3.21.6 or later
```
npm install nuxt@3.21.6
```

Technical details

A reflected Cross-Site Scripting (XSS) vulnerability exists in Nuxt's `navigateTo()` composable when the `external: true` option is used. During server-side rendering (SSR), Nuxt generates an HTML body containing a `<meta http-equiv="refresh">` tag for the redirect. The destination URL was only sanitized by escaping double quotes, failing to encode other HTML-significant characters like `<`, `>`, `&`, and `'`. An attacker can provide a crafted URL (e.g., via a redirect query parameter) that breaks out of the `content` attribute to inject and execute arbitrary JavaScript in the context of the application's origin. This has been patched in versions 3.21.6 and 4.4.6 by implementing full HTML attribute encoding.

Affected products

Nuxt Nuxt >= 3.4.3, < 3.21.6; >= 4.0.0-alpha.1, < 4.4.6

Identifiers

CVE-2026-45669
GHSA-fx6j-w5w5-h468

Timeline

2026-05-11: patched: Fix merged in GitHub pull request #35052
2026-05-18: advisory: GitHub Security Advisory GHSA-fx6j-w5w5-h468 published
2026-06-12: disclosed: CVE-2026-45669 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.