Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| nuxt | npm | >= 4.0.0, < 4.4.7 | 4.4.7 |
| nuxt | npm | < 3.21.7 | 3.21.7 |
Miggo AIRoot Cause AnalysisThe analysis of the provided patches reveals three distinct vulnerabilities within the Nuxt framework's URL handling capabilities, affecting the navigateTo and reloadNuxtApp functions. The root causes are improper input validation and sanitization of URLs.
navigateTo SSR Open Redirect: The navigateTo function, when used on the server, relied on the encodeURL helper function. encodeURL failed to handle path normalization for inputs like /..//evil.com. These inputs would bypass the initial same-origin check but would be interpreted by the browser as a protocol-relative URL (//evil.com), leading to an open redirect. The fix involves collapsing multiple leading slashes in the path to ensure it's treated as a same-origin path.
navigateTo Client-Side XSS: On the client, navigateTo with the { open: ... } option would directly pass the URL to window.open. It lacked a check for script protocols (e.g., javascript:). This allowed an attacker to execute arbitrary JavaScript in the context of the user's session if a user-controlled URL was passed to this function.
reloadNuxtApp Open Redirect: The reloadNuxtApp function was also vulnerable to an open redirect. It did not check if the host of the provided path matched the host of the current window's location. This allowed for protocol-relative URLs like //evil.com to be used, redirecting the user to an external site. The patch adds a host comparison to prevent this.
The identified vulnerable functions (navigateTo, encodeURL, reloadNuxtApp) are the exact locations where these flaws existed and were subsequently patched. Any runtime profile during an exploit of these vulnerabilities would show these functions in the stack trace.
navigateTopackages/nuxt/src/app/composables/router.ts
encodeURLpackages/nuxt/src/app/composables/router.ts
reloadNuxtApppackages/nuxt/src/app/composables/chunk.ts