Executive brief
Nuxt, a popular web development framework, contains vulnerabilities in how it handles website addresses during navigation and app reloading. An attacker could trick a user into clicking a malicious link that redirects them to a fraudulent website designed to steal login credentials or sensitive authorization codes. In some cases, this could also allow an attacker to run unauthorized scripts in the user's browser.
Technical details
Nuxt versions 4.x before 4.4.7 and 3.x before 3.21.7 contain multiple URL-handling weaknesses in the `navigateTo` and `reloadNuxtApp` APIs. The `reloadNuxtApp` function fails to properly block protocol-relative paths (e.g., `//evil.com`), which bypass script-protocol checks but resolve to cross-origin URLs, leading to open redirects. Additionally, `navigateTo` is vulnerable to an SSR open redirect via path-normalization bypass and client-side XSS when the `open` option is used, as it bypasses `isScriptProtocol` checks. Attackers can exploit these by providing specially crafted URLs to applications that forward user-controlled input into these functions. The issues are patched in Nuxt 4.4.7 and 3.21.7.
Affected products
- Nuxt Nuxt >= 4.0.0, < 4.4.7; 3.x < 3.21.7
Timeline
- 2026-06-02: advisory: GitHub Security Advisory GHSA-c9cv-mq2m-ppp3 published
- 2026-06-22: disclosed: CVE-2026-56697 published to NVD
References
- https://github.com/nuxt/nuxt/commit/6497d99dd106254abd089f6a263d7773869a343b
- https://github.com/nuxt/nuxt/commit/e447a793c47766834f7497f8412a76cd56fd8ee1
- https://github.com/nuxt/nuxt/security/advisories/GHSA-c9cv-mq2m-ppp3
- https://www.vulncheck.com/advisories/nuxt-open-redirect-via-protocol-relative-paths-in-reloadnuxtapp