nuxt-nitro-server

Ecosystem: npm

Downloads: 8.78 Mln

Vulnerabilities from the last (months)

0CriticalAffects 0 versions
0HighAffects 0 versions
0MediumAffects 0 versions
3ModerateAffects 5 versions
1LowAffects 2 versions

Severity distribution (all time)

4vulnerabilities

Critical0 (0.0%)
High0 (0.0%)
Medium0 (0.0%)
Moderate3 (75.0%)
Low1 (25.0%)

Monthly breakdown

Critical
High
Medium
Moderate
Low

Oct 20262 vulnerabilities
- Critical: 0
- High: 0
- Medium: 0
- Moderate: 2
- Low: 0
May 20262 vulnerabilities
- Critical: 0
- High: 0
- Medium: 0
- Moderate: 1
- Low: 1

Vulnerabilities (4)

Known vulnerabilities affecting nuxt-nitro-server, based on data from OSV.

Filter by severitySort by

Vulnerabilities affecting nuxt-nitro-server
ID	Severity	Summary	Affected versions	Published	Source
GHSA-9v7c-q64q-vv33	Moderate	Nuxt: Dot segments in the request path bypass `server/middleware` path checks and server route rules on page routes### Summary Since `4.6.0`, Nuxt resolves `.` and `..` segments in the request path, including percent-encoded forms such as `%2e`, before rendering a page. Nitro's routing, Nitro's route rules and `server/middleware` see the path with those segments still in place. A request for `/%2e/admin` therefore renders the page at `/admin`, while server-side checks keyed on `/admin` do not apply. ### Impact An unauthenticated attacker can bypass server-side controls that match on the request path of a page route. `server/middleware` that checks `event.path` (or `event.node.req.url`) is skipped: ```	`>= 4.6.0, < 4.6.3`	2026-10-30	GitHub (opens in a new tab)
GHSA-vjh5-4x84-xrqp	Moderate	Nuxt: Server-side route rules (`redirect`, `headers`, `proxy`, `ssr`) are skipped for case-variant paths when routing is case-insensitive## Impact With the default `router.options.sensitive: false`, Nuxt's page router resolves routes case-insensitively, so `/Admin` renders the same page as `/admin`. On the server, however, route rules were resolved with Nitro's route-rule matcher, which matches keys case-sensitively. A request whose path differs from a rule key only in letter case therefore rendered the page with none of that rule applied. Earlier fixes ([GHSA-mm7m-92g8-7m47](https://github.com/nuxt/nuxt/security/advisories/GHSA-mm7m-92g8-7m47), [GHSA-hxvh-4h3w-prp9](https://github.com/nuxt/nuxt/security/advisories/GHSA-hxvh-	`>= 4.2.0, < 4.6.2` `>= 3.20.0`	2026-10-22	GitHub (opens in a new tab)
GHSA-hg3f-28rg-4jxj	Moderate	Nuxt's route middleware is not enforced when rendering `.server.vue` pages via `/__nuxt_island/page_`### Summary When `experimental.componentIslands` is enabled (default in Nuxt 4), any `.server.vue` file under `pages/` is automatically registered as a server island under the key `page_<routeName>` and exposed via the `/__nuxt_island/:name` endpoint. Until this fix, requests through that endpoint rendered the page component directly via the SSR renderer without instantiating Vue Router, which meant route middleware declared on the page (including `definePageMeta({ middleware })`) did not run. For Nuxt applications that gate a `.server.vue` page* behind route middleware as their sole auth c	`>= 3.20.0, < 3.21.6` `>= 4.2.0, < 4.4.6`	2026-05-29	GitHub (opens in a new tab)
GHSA-g8wj-3cr3-6w7v	Low	Nuxt: `__nuxt_island` endpoint does not bind responses to request props, enabling shared-cache poisoning### Summary The `/__nuxt_island/*` endpoint accepts attacker-controlled `props` query/body parameters and renders any island component without verifying that the URL-resident hash (`<Name>_<hashId>.json`) was actually issued for those inputs by `<NuxtIsland>`. The hash is computed and embedded client-side but never validated server-side, so the same path can return materially different responses depending on the query. Island components are documented as rendering independently of route context - page middleware does not apply to them, and they are intentionally cacheable as a function of th	`>= 3.20.0, < 3.21.6` `>= 4.2.0, < 4.4.6`	2026-05-19	GitHub (opens in a new tab)

GHSA-9v7c-q64q-vv33Moderate
Nuxt: Dot segments in the request path bypass `server/middleware` path checks and server route rules on page routes
- >= 4.6.0, < 4.6.3
2026-10-30GitHub (opens in a new tab)
### Summary Since `4.6.0`, Nuxt resolves `.` and `..` segments in the request path, including percent-encoded forms such as `%2e`, before rendering a page. Nitro's routing, Nitro's route rules and `server/middleware` see the path with those segments still in place. A request for `/%2e/admin` therefore renders the page at `/admin`, while server-side checks keyed on `/admin` do not apply. ### Impact An unauthenticated attacker can bypass server-side controls that match on the request path of a page route. `server/middleware` that checks `event.path` (or `event.node.req.url`) is skipped: ```
CVE: CVE-2026-119200
GHSA-vjh5-4x84-xrqpModerate
Nuxt: Server-side route rules (`redirect`, `headers`, `proxy`, `ssr`) are skipped for case-variant paths when routing is case-insensitive
- >= 4.2.0, < 4.6.2
- >= 3.20.0
2026-10-22GitHub (opens in a new tab)
## Impact With the default `router.options.sensitive: false`, Nuxt's page router resolves routes case-insensitively, so `/Admin` renders the same page as `/admin`. On the server, however, route rules were resolved with Nitro's route-rule matcher, which matches keys case-sensitively. A request whose path differs from a rule key only in letter case therefore rendered the page with none of that rule applied. Earlier fixes ([GHSA-mm7m-92g8-7m47](https://github.com/nuxt/nuxt/security/advisories/GHSA-mm7m-92g8-7m47), [GHSA-hxvh-4h3w-prp9](https://github.com/nuxt/nuxt/security/advisories/GHSA-hxvh-
CVE: CVE-2026-114132
GHSA-hg3f-28rg-4jxjModerate
Nuxt's route middleware is not enforced when rendering `.server.vue` pages via `/__nuxt_island/page_*`
- >= 3.20.0, < 3.21.6
- >= 4.2.0, < 4.4.6
2026-05-29GitHub (opens in a new tab)
### Summary When `experimental.componentIslands` is enabled (default in Nuxt 4), any `.server.vue` file under `pages/` is automatically registered as a server island under the key `page_<routeName>` and exposed via the `/__nuxt_island/:name` endpoint. Until this fix, requests through that endpoint rendered the page component directly via the SSR renderer without instantiating Vue Router, which meant route middleware declared on the page (including `definePageMeta({ middleware })`) did not run. For Nuxt applications that gate a `.server.vue` *page* behind route middleware as their sole auth c
CVE: CVE-2026-47200
GHSA-g8wj-3cr3-6w7vLow
Nuxt: `__nuxt_island` endpoint does not bind responses to request props, enabling shared-cache poisoning
- >= 3.20.0, < 3.21.6
- >= 4.2.0, < 4.4.6
2026-05-19GitHub (opens in a new tab)
### Summary The `/__nuxt_island/*` endpoint accepts attacker-controlled `props` query/body parameters and renders any island component without verifying that the URL-resident hash (`<Name>_<hashId>.json`) was actually issued for those inputs by `<NuxtIsland>`. The hash is computed and embedded client-side but never validated server-side, so the same path can return materially different responses depending on the query. Island components are documented as rendering independently of route context - page middleware does not apply to them, and they are intentionally cacheable as a function of th
CVE: CVE-2026-46342