Socket Releases Free Certified Patches for Nuxt Security Vulnerabilities

Nuxt has released security updates for multiple vulnerabilities affecting Nuxt 3.x and 4.x, along with a separate critical development-only vulnerability in @nuxt/devtools.

Nuxt 4.5.1 and 3.21.10 address issues including server-side remote code execution, authorization bypass, denial of service, and cross-user payload disclosure. @nuxt/devtools 3.3.1 fixes a critical remote code execution vulnerability affecting development servers.

Socket has published Certified Patches for two of the disclosed Nuxt advisories and is preparing patches for the remaining issues. Certified Patches for Critical and High severity vulnerabilities are free to use, including for teams that are not Socket customers.

Impact#

The Nuxt release addresses eight GitHub Security Advisories across Nuxt and Nuxt DevTools.

The most serious production issue, GHSA-9473-5f9j-94wq, can enable server-side remote code execution through server island props. It requires vue.runtimeCompiler to be enabled, which is off by default, along with an application pattern where attacker-controlled island props reach Vue’s dynamic component resolution.

A related vulnerability, GHSA-48hr-524c-v5w3, can allow unauthorized instantiation of HTML elements or globally registered components through server island props. It does not enable code execution, but it can affect applications using polymorphic component patterns or Vue attribute fallthrough.

Other fixes address:

• A route-rule authorization bypass when appMiddleware is used with route rules containing uppercase characters
• Two denial-of-service issues affecting server components and islands
• Cross-user disclosure of cached Nuxt payloads on authenticated pages in Nuxt 4.x
• A development-server path disclosure issue
• Critical remote code execution in Nuxt DevTools when running nuxt dev with DevTools enabled

The DevTools issue affects development environments, not production deployments. It can be reached by another process on the host, users on the local network when the dev server is exposed with --host, or a malicious site visited while the dev server is running.

Upgrade Nuxt and Nuxt DevTools#

Nuxt recommends upgrading to Nuxt 4.5.1 or 3.21.10:

npx nuxt upgrade --dedupe

Refresh your lockfile as part of the upgrade to ensure it resolves @nuxt/devtools@3.3.1 or later.

Teams using authenticated pages with Nuxt cache, swr, or isr route rules should also purge CDN and edge caches after upgrading. Previously cached _payload.json responses may remain available until explicitly evicted.

Free Socket Certified Patches Available#

Socket has published a free Certified Patch for GHSA-9473-5f9j-94wq, the high-severity server-side remote code execution issue involving server island props.

Apply it with:

socket patch add GHSA-9473-5f9j-94wq

You can also view the Certified Patch for an affected version here.

Socket has also published a Certified Patch for GHSA-48hr-524c-v5w3, which addresses unauthorized component instantiation through server island props:

socket patch add GHSA-48hr-524c-v5w3

A patch for an affected version is available here.

Certified Patches apply a minimal, reviewed change directly to vulnerable package versions while preserving the rest of the package’s behavior. They allow teams to remediate an issue without waiting on a full dependency upgrade or dependency-tree refactor.

We are preparing Certified Patches for the remaining Nuxt advisories and will update this post as they are completed. Once all patches are available, Socket’s merged patches will provide a consolidated way to remediate the full set of disclosed Nuxt vulnerabilities.

Recommended Actions#

Organizations using Nuxt should:

• Upgrade Nuxt to 4.5.1 or 3.21.10 as soon as possible.
• Upgrade @nuxt/devtools to 3.3.1 or later and refresh lockfiles.
• Check direct and transitive dependencies for affected Nuxt and DevTools versions.
• Apply a Socket Certified Patch where an immediate dependency upgrade is not practical.
• Purge CDN and edge caches if authenticated pages use cache, swr, or isr route rules.
• Review server-island components that pass untrusted props into dynamic or polymorphic Vue component patterns.
• Check whether appMiddleware protects routes whose route-rule keys include uppercase characters.
• Avoid exposing development servers to untrusted networks, especially when DevTools is enabled.