Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| nuxt | npm | >= 4.0.0, < 4.4.7 | 4.4.7 |
| nuxt | npm | < 3.21.7 | 3.21.7 |
Miggo AIRoot Cause AnalysisThe analysis of the provided patches reveals three distinct vulnerabilities within the Nuxt.js framework, all related to improper URL handling in navigation functions. The core of the problem lies in insufficient validation of user-supplied input passed to navigateTo and reloadNuxtApp.
Open Redirect in navigateTo (SSR): The navigateTo function, when executed on the server, used a helper function encodeURL that failed to properly sanitize URL paths. This allowed for a path-normalization bypass where an input like //evil.com would be treated as a relative path by the server-side check but as a protocol-relative, external domain by the browser, leading to an open redirect. The patch for encodeURL corrects this by collapsing leading slashes.
XSS in navigateTo (Client-Side): On the client, navigateTo with the open: true option would pass the URL directly to window.open without checking for dangerous protocols. This created a cross-site scripting (XSS) vulnerability, as an attacker could supply a javascript: payload to execute arbitrary code in the user's browser. The patch adds a protocol check to block script-like schemes.
Open Redirect in reloadNuxtApp: The reloadNuxtApp function was also vulnerable to an open redirect via protocol-relative URLs. It lacked a check to ensure the target URL belonged to the same origin as the application. The patch resolves this by comparing the host of the target URL with the current application's host, preventing redirects to external sites.
These functions are critical for runtime profiling as they are the entry points for the vulnerable logic and would be present in any stack trace related to the exploitation of these vulnerabilities.
navigateTopackages/nuxt/src/app/composables/router.ts
JavaScriptJavaScriptencodeURLpackages/nuxt/src/app/composables/router.ts
reloadNuxtApppackages/nuxt/src/app/composables/chunk.ts