nuxt-security rce-vulnerability server-islands critical-upgrade cache-disclosure

Nuxt patches eight vulnerabilities including RCE

Upgrade to Nuxt 4.5.1 or 3.21.10 immediately—high-severity RCE in server islands and authorization bypass in route rules require patched versions, Vercel WAF mitigations are not a replacement.

Summary

Server-side RCE and cross-user cache disclosure directly compromise production apps; relying on platform-level protections without upgrading leaves component instantiation, caching, and DoS vectors exposed. Non-negotiable dependency bump for any Nuxt deployment handling authenticated data.

Why it matters

Implementation verdict

Replace current Nuxt versions with patched releases via `npx nuxt upgrade --dedupe`—requires lockfile refresh and DevTools bump to 3.3.1. Critical for production; no workaround exists. Also required: purge upstream caches if serving authenticated payloads pre-patch. Start now.

Sources

1.eight security advisories, including a high-severity server-side remote code execution vulnerability
2.Nuxt 4: `4.5.1` or later, Nuxt 3: `3.21.10` or later, Nuxt DevTools: `3.3.1` or later
3.Vercel received advance notice of the server-side remote code execution vulnerability, [GHSA-9473-5f9j-94wq], and deployed platform-wide WAF mitigations before public disclosure
4.do not rely on them for full protection. Upgrading to a patched version is still required
5.The newly disclosed authorization bypass is a regression in that earlier fix

Dev Signal

Get briefs like this in your inbox — free, every weekday.

100+ sources compressed into one 4-minute read. Ranked, cited, implementation-ready.

Read the full issue →All briefs