# Nuxt UI UForm credential leakage via GET before hydration

Source: https://junglewise.ai/threats/nuxt-ui-uform-credential-leakage-via-get-before-hydration-0888d6da  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-02. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

Severity: medium · CVSS 4 · Published 2026-07-02

Nuxt UI's form components (UForm and UAuthForm) render HTML forms without specifying a submission method, causing credentials to be sent as URL query parameters if users submit the form before the application fully loads. Passwords and email addresses can leak into browser history, HTTP referrer headers, CDN logs, and network monitoring tools, potentially exposing user credentials to anyone with access to these systems.

Vendors: [npm](https://junglewise.ai/threats/vendors/npm), [Nuxt](https://junglewise.ai/threats/vendors/nuxt).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Medium severity, with a CVSS score of 4, published 2 July 2026.

**Which products and versions are affected?** @nuxt/ui (npm) SEMVER:introduced=0,fixed=4.8.1; Nuxt UI <4.8.1.

**Is there a fix for This vulnerability?** Yes. @nuxt/ui (npm): upgrade to 4.8.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network, in a software library.

**Am I affected?** Check whether you run @nuxt/ui (npm) or Nuxt UI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @nuxt/ui (npm): upgrade to 4.8.1 or later

  ```sh
  npm install @nuxt/ui@4.8.1
  ```


## Technical details

The vulnerability is a timing-based information disclosure (CWE-200, CWE-598) in server-side rendering of UForm and UAuthForm components in @nuxt/ui. The rendered form element has no method attribute and relies on Vue's @submit.prevent handler (which only attaches after client-side hydration) to intercept submission. If a user submits the form before hydration completes—due to slow network, CSP-blocked JavaScript, or CDN failure—the browser defaults to GET submission, serializing all named form fields (including password inputs) into the query string. The password then appears in the URL, browser history, referrer headers, access logs, and WAF/CDN records. The fix, available in version 4.8.1, explicitly sets method="post" on the form element so pre-hydration submissions use POST instead of GET.

## Affected products

- Nuxt UI <4.8.1

## Timeline

- 2026-07-02: disclosed
- 2026-07-02: patched: Fixed in v4.8.1 via PR #6512

## References

- [https://github.com/nuxt/ui/security/advisories/GHSA-gj2h-2fpw-fhv9](https://github.com/nuxt/ui/security/advisories/GHSA-gj2h-2fpw-fhv9)
- [https://github.com/nuxt/ui/pull/6512](https://github.com/nuxt/ui/pull/6512)

## Related threats

- [Nuxt UI form credential leaking via pre-hydration GET submission](https://junglewise.ai/threats/cve-2026-123808-nuxt-ui-is-an-intuitive-vue-ui-library-powered-by-reka-ui-and)