Executive brief
Nuxt, a popular web development framework, contains vulnerabilities in how it handles website navigation and page reloads. An attacker could trick a user into clicking a malicious link that executes unauthorized code in their browser or redirects them to a fraudulent website designed to steal login credentials. This could lead to the theft of sensitive user data, such as session tokens or personal information, and damage the reputation of applications built with the framework.
Technical details
Nuxt fails to properly validate URLs in the 'navigateTo' and 'reloadNuxtApp' functions, leading to three distinct issues: an SSR open redirect via path-normalization bypass, client-side XSS via the 'open' option in 'navigateTo', and an open redirect in 'reloadNuxtApp' via protocol-relative URL bypass. The XSS occurs because the client-side early-open handler fails to apply the 'isScriptProtocol' check, allowing 'javascript:' URLs to execute in the application's origin. The open redirects occur because certain malformed paths (e.g., starting with '/..//') bypass protocol checks but are normalized by browsers to cross-origin locations. These vulnerabilities are reachable via network requests if an application passes user-controlled input to the affected APIs. Patches are available in Nuxt versions 4.4.7 and 3.21.7.
Affected products
- Nuxt Nuxt >= 4.0.0, < 4.4.7; < 3.21.7
Timeline
- 2026-06-02: advisory: GitHub Security Advisory GHSA-c9cv-mq2m-ppp3 published
- 2026-06-22: disclosed: CVE-2026-56698 published to NVD
References
- https://github.com/nuxt/nuxt/commit/3394716d4a913cba904b028df5338f2aead50032
- https://github.com/nuxt/nuxt/commit/62fc32eddf648b00a3890141e0235d2a222b024d
- https://github.com/nuxt/nuxt/security/advisories/GHSA-c9cv-mq2m-ppp3
- https://www.vulncheck.com/advisories/nuxt-cross-site-scripting-via-navigateto-open-option