# CVE-2026-56326: Nuxt open redirect and XSS in navigateTo and reloadNuxtApp

Source: https://junglewise.ai/threats/cve-2026-56326-nuxt-open-redirect-and-xss-in-navigateto-and-reloadnuxtapp  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-22. Updated: 2026-06-22  
License: CC BY 4.0 with a link back

CVE-2026-56326 · Severity: medium · CVSS 6.1 · Published 2026-06-22

Nuxt, a popular web development framework, contains a security flaw in how it handles website redirects. An attacker can trick the system into sending users to a malicious external website by using specially crafted web addresses. This could be used in phishing attacks to steal user credentials or sensitive login tokens (OAuth codes) by making a malicious link appear to belong to a trusted site.

Technologies: [nuxt (npm)](https://junglewise.ai/threats/technologies/nuxt). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-56326 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-56326 being exploited in the wild.

**How severe is CVE-2026-56326?** Medium severity, with a CVSS score of 6.1, published 22 June 2026.

**Which products and versions are affected?** nuxt (npm) SEMVER:introduced=4.0.0,fixed=4.4.7.

**Is there a fix for CVE-2026-56326?** Yes. nuxt (npm): upgrade to 4.4.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-56326 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-56326?** Check whether you run nuxt (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- nuxt (npm): upgrade to 4.4.7 or later

  ```sh
  npm install nuxt@4.4.7
  ```


## Technical details

Nuxt contains multiple URL-handling weaknesses in its 'navigateTo' and 'reloadNuxtApp' composables. The primary issue is a server-side open redirect caused by a path-normalization bypass; the framework's 'hasProtocol' check fails to identify payloads like '/..//evil.com' as external, but the WHATWG URL parser subsequently normalizes them to protocol-relative paths. Additionally, 'navigateTo' fails to apply script-protocol guards when the 'open' option is used, leading to reflected XSS, and 'reloadNuxtApp' is susceptible to protocol-relative bypasses. Attackers can exploit these by providing malicious URLs to application routes that forward user input to these functions. The vulnerabilities are patched in Nuxt versions 4.4.7 and 3.21.7.

## Affected products

- Nuxt Nuxt >= 4.0.0, < 4.4.7; 3.x < 3.21.7

## Identifiers

- CVE-2026-56326
- GHSA-c9cv-mq2m-ppp3

## Timeline

- 2026-06-02: advisory: GitHub Security Advisory GHSA-c9cv-mq2m-ppp3 published
- 2026-06-22: disclosed: CVE-2026-56326 published to NVD

## References

- [https://github.com/nuxt/nuxt/commit/1f2dd5e78c77576437138e97671965573c232835](https://github.com/nuxt/nuxt/commit/1f2dd5e78c77576437138e97671965573c232835)
- [https://github.com/nuxt/nuxt/commit/2cce6fb02e621196d56df92e05594e07469b5a6d](https://github.com/nuxt/nuxt/commit/2cce6fb02e621196d56df92e05594e07469b5a6d)
- [https://github.com/nuxt/nuxt/security/advisories/GHSA-c9cv-mq2m-ppp3](https://github.com/nuxt/nuxt/security/advisories/GHSA-c9cv-mq2m-ppp3)
- [https://www.vulncheck.com/advisories/nuxt-server-side-open-redirect-via-path-normalization-bypass-in-navigateto](https://www.vulncheck.com/advisories/nuxt-server-side-open-redirect-via-path-normalization-bypass-in-navigateto)

## Related threats

- [Nuxt path traversal via dot segment normalization bypass](https://junglewise.ai/threats/cve-2026-119200-nuxt-is-an-open-source-web-development-framework-for-vue-js-from)
- [Nuxt stored cross-site scripting in useHeadSafe server island rendering](https://junglewise.ai/threats/cve-2026-114133-nuxt-is-an-open-source-web-development-framework-for-vue-js-from)
- [Nuxt case-sensitive route matching bypass](https://junglewise.ai/threats/cve-2026-114132-nuxt-is-an-open-source-web-development-framework-for-vue-js)
- [Nuxt route-rule bypass via percent-encoded segments](https://junglewise.ai/threats/cve-2026-114131-nuxt-is-an-open-source-web-development-framework-for-vue-js-from)
- [Nuxt XSS via protocol bypass in NuxtLink](https://junglewise.ai/threats/cve-2026-114130-nuxt-is-an-open-source-web-development-framework-for-vue-js)