Is CVE-2026-56326 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-56326 being exploited in the wild.

How severe is CVE-2026-56326?

Medium severity, with a CVSS score of 6.1, published 22 June 2026.

Which products and versions are affected?

nuxt (npm) SEMVER:introduced=4.0.0,fixed=4.4.7.

Is there a fix for CVE-2026-56326?

Yes. nuxt (npm): upgrade to 4.4.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-56326 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-56326?

Check whether you run nuxt (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-56326: Nuxt open redirect and XSS in navigateTo and reloadNuxtApp

CVE-2026-56326 · Severity: medium · CVSS 6.1 · Published 2026-06-22

Nuxt, a popular web development framework, contains a security flaw in how it handles website redirects. An attacker can trick the system into sending users to a malicious external website by using specially crafted web addresses. This could be used in phishing attacks to steal user credentials or sensitive login tokens (OAuth codes) by making a malicious link appear to belong to a trusted site.

Technologies: nuxt (npm). Vendors: npm.

Quick answers

Is CVE-2026-56326 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-56326 being exploited in the wild.
How severe is CVE-2026-56326?: Medium severity, with a CVSS score of 6.1, published 22 June 2026.
Which products and versions are affected?: nuxt (npm) SEMVER:introduced=4.0.0,fixed=4.4.7.
Is there a fix for CVE-2026-56326?: Yes. nuxt (npm): upgrade to 4.4.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-56326 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-56326?: Check whether you run nuxt (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

nuxt (npm): upgrade to 4.4.7 or later
```
npm install nuxt@4.4.7
```

Technical details

Nuxt contains multiple URL-handling weaknesses in its 'navigateTo' and 'reloadNuxtApp' composables. The primary issue is a server-side open redirect caused by a path-normalization bypass; the framework's 'hasProtocol' check fails to identify payloads like '/..//evil.com' as external, but the WHATWG URL parser subsequently normalizes them to protocol-relative paths. Additionally, 'navigateTo' fails to apply script-protocol guards when the 'open' option is used, leading to reflected XSS, and 'reloadNuxtApp' is susceptible to protocol-relative bypasses. Attackers can exploit these by providing malicious URLs to application routes that forward user input to these functions. The vulnerabilities are patched in Nuxt versions 4.4.7 and 3.21.7.

Affected products

Nuxt Nuxt >= 4.0.0, < 4.4.7; 3.x < 3.21.7

Identifiers

CVE-2026-56326
GHSA-c9cv-mq2m-ppp3

Timeline

2026-06-02: advisory: GitHub Security Advisory GHSA-c9cv-mq2m-ppp3 published
2026-06-22: disclosed: CVE-2026-56326 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.