Executive brief
Nuxt, a popular web development framework, contains a security flaw in how it handles website redirects. An attacker can trick the system into sending users to a malicious external website by using specially crafted web addresses. This could be used in phishing attacks to steal user credentials or sensitive login tokens (OAuth codes) by making a malicious link appear to belong to a trusted site.
Technical details
Nuxt contains multiple URL-handling weaknesses in its 'navigateTo' and 'reloadNuxtApp' composables. The primary issue is a server-side open redirect caused by a path-normalization bypass; the framework's 'hasProtocol' check fails to identify payloads like '/..//evil.com' as external, but the WHATWG URL parser subsequently normalizes them to protocol-relative paths. Additionally, 'navigateTo' fails to apply script-protocol guards when the 'open' option is used, leading to reflected XSS, and 'reloadNuxtApp' is susceptible to protocol-relative bypasses. Attackers can exploit these by providing malicious URLs to application routes that forward user input to these functions. The vulnerabilities are patched in Nuxt versions 4.4.7 and 3.21.7.
Affected products
- Nuxt Nuxt >= 4.0.0, < 4.4.7; 3.x < 3.21.7
Timeline
- 2026-06-02: advisory: GitHub Security Advisory GHSA-c9cv-mq2m-ppp3 published
- 2026-06-22: disclosed: CVE-2026-56326 published to NVD
References
- https://github.com/nuxt/nuxt/commit/1f2dd5e78c77576437138e97671965573c232835
- https://github.com/nuxt/nuxt/commit/2cce6fb02e621196d56df92e05594e07469b5a6d
- https://github.com/nuxt/nuxt/security/advisories/GHSA-c9cv-mq2m-ppp3
- https://www.vulncheck.com/advisories/nuxt-server-side-open-redirect-via-path-normalization-bypass-in-navigateto