Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Medium severity, with a CVSS score of 4, published 2 July 2026.

Which products and versions are affected?

@nuxt/ui (npm) SEMVER:introduced=0,fixed=4.8.1; Nuxt UI <4.8.1.

Is there a fix for This vulnerability?

Yes. @nuxt/ui (npm): upgrade to 4.8.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network, in a software library.

Check whether you run @nuxt/ui (npm) or Nuxt UI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Nuxt UI UForm credential leakage via GET before hydration

Q: Is there a fix for This vulnerability?

Yes. @nuxt/ui (npm): upgrade to 4.8.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is This vulnerability attacked?

It is attacked over the network, in a software library.

Q: Am I affected?

Check whether you run @nuxt/ui (npm) or Nuxt UI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Severity: medium · CVSS 4 · Published 2026-07-02

Nuxt UI's form components (UForm and UAuthForm) render HTML forms without specifying a submission method, causing credentials to be sent as URL query parameters if users submit the form before the application fully loads. Passwords and email addresses can leak into browser history, HTTP referrer headers, CDN logs, and network monitoring tools, potentially exposing user credentials to anyone with access to these systems.

Vendors: npm, Nuxt.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Medium severity, with a CVSS score of 4, published 2 July 2026.
Which products and versions are affected?: @nuxt/ui (npm) SEMVER:introduced=0,fixed=4.8.1; Nuxt UI <4.8.1.
Is there a fix for This vulnerability?: Yes. @nuxt/ui (npm): upgrade to 4.8.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network, in a software library.
Am I affected?: Check whether you run @nuxt/ui (npm) or Nuxt UI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@nuxt/ui (npm): upgrade to 4.8.1 or later
```
npm install @nuxt/ui@4.8.1
```

Technical details

The vulnerability is a timing-based information disclosure (CWE-200, CWE-598) in server-side rendering of UForm and UAuthForm components in @nuxt/ui. The rendered form element has no method attribute and relies on Vue's @submit.prevent handler (which only attaches after client-side hydration) to intercept submission. If a user submits the form before hydration completes—due to slow network, CSP-blocked JavaScript, or CDN failure—the browser defaults to GET submission, serializing all named form fields (including password inputs) into the query string. The password then appears in the URL, browser history, referrer headers, access logs, and WAF/CDN records. The fix, available in version 4.8.1, explicitly sets method="post" on the form element so pre-hydration submissions use POST instead of GET.

Affected products

Nuxt UI <4.8.1

Timeline

2026-07-02: disclosed
2026-07-02: patched: Fixed in v4.8.1 via PR #6512

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.