20260727-2257-socket.dev-f1a58 | Perceptive Security

Socket releases free Certified Patches for high-severity Nuxt vulnerabilities, including server-side remote code execution through server island props.

Published:

27 July 2026 at 22:57:36

Alert date:

28 July 2026 at 00:01:16

Source:

socket.dev

Web Technologies, Supply Chain & Dependencies, Zero-Day Vulnerabilities

Nuxt has released security updates addressing multiple vulnerabilities in Nuxt 3.x and 4.x, including server-side remote code execution via server island props (GHSA-9473-5f9j-94wq), unauthorized HTML element instantiation (GHSA-48hr-524c-v5w3), authorization bypass, denial of service, and cross-user payload disclosure. A separate critical RCE vulnerability was fixed in @nuxt/devtools 3.3.1 affecting development servers. Fixed versions are Nuxt 4.5.1 and 3.21.10. Socket has released free Certified Patches for the two most critical advisories, allowing teams to remediate without a full dependency upgrade. Organizations are advised to upgrade immediately, refresh lockfiles, purge CDN caches for authenticated pages, and avoid exposing dev servers with DevTools enabled to untrusted networks.

Technical details

Nuxt 3.x and 4.x contain multiple vulnerabilities addressed in versions 4.5.1 and 3.21.10. The most critical production issue (GHSA-9473-5f9j-94wq) allows server-side remote code execution (SSRCE) through server island props when vue.runtimeCompiler is enabled and attacker-controlled island props reach Vue's dynamic component resolution. A related issue (GHSA-48hr-524c-v5w3) allows unauthorized instantiation of HTML elements or globally registered components via server island props, impacting polymorphic component patterns or Vue attribute fallthrough. Additional vulnerabilities include: a route-rule authorization bypass when appMiddleware is used with route rules containing uppercase characters; two denial-of-service issues affecting server components and islands; cross-user disclosure of cached Nuxt payloads (_payload.json) on authenticated pages in Nuxt 4.x when using cache/swr/isr route rules; a development-server path disclosure issue; and a critical RCE in @nuxt/devtools (fixed in 3.3.1) when running 'nuxt dev' with DevTools enabled, exploitable by local processes, local network users when --host flag is used, or via malicious websites visited while the dev server is running.

Mitigation steps:

1. Upgrade Nuxt to version 4.5.1 or 3.21.10 as soon as possible using: npx nuxt upgrade --dedupe. 2. Upgrade @nuxt/devtools to 3.3.1 or later and refresh lockfiles to ensure the updated version is resolved. 3. Check direct and transitive dependencies for affected Nuxt and DevTools versions. 4. Apply Socket Certified Patch for GHSA-9473-5f9j-94wq via: socket patch add GHSA-9473-5f9j-94wq. 5. Apply Socket Certified Patch for GHSA-48hr-524c-v5w3 via: socket patch add GHSA-48hr-524c-v5w3. 6. Purge CDN and edge caches if authenticated pages use cache, swr, or isr route rules, as previously cached _payload.json responses may still be accessible. 7. Review server-island components that pass untrusted props into dynamic or polymorphic Vue component patterns. 8. Check whether appMiddleware protects routes whose route-rule keys include uppercase characters. 9. Avoid exposing development servers to untrusted networks, especially when DevTools is enabled.

Affected products:

Nuxt 3.x (fixed in 3.21.10)
Nuxt 4.x (fixed in 4.5.1)
@nuxt/devtools (fixed in 3.3.1)