npm - OSV

GHSA-2x6f-rp82-ppmj

npm/nuxt-og-image

Nuxt OG Image cache poisoning through derivable cache keys on unsigned dynamic... yesterday

Fix available
Severity - 6.9 (Medium)

MAL-2026-17498

npm/@kibt/www-nuxt-i18n

Malicious code in @kibt/www-nuxt-i18n (npm) 04 Oct

No fix available

GHSA-q8hw-4fvp-9rwv

npm/nuxt-og-image

Nuxt OG Image has unauthenticated SSRF via `fonts[].path` URL parameter 17 Sep

Fix available
Severity - 6.9 (Medium)

GHSA-fxg7-897c-57mp

npm/nuxt-ollama

Nuxt Ollama: Public Runtime Config Exposes Ollama API Key to Browser Clients 09 Sep

Fix available
Severity - 7.5 (High)

MAL-2026-13625

npm/@depup/nuxt

Malicious code in @depup/nuxt (npm) 07 Aug

No fix available

GHSA-7c4v-fwgw-9rf7

npm/nuxt

Nuxt dev server discloses project root and workspace UUID via the Chrome DevTools workspace endpoint 07 Aug

Fix available
Severity - 5.3 (Medium)

GHSA-9pgf-384g-p7mv

npm/nuxt

Nuxt: Unauthenticated CPU exhaustion parsing and hashing the Nuxt island endpoint body before hash validation 05 Aug

Fix available
Severity - 7.5 (High)

GHSA-9473-5f9j-94wq

npm/nuxt

Nuxt: Server-Side Remote Code Execution via Runtime Template Injection in Nuxt Server Island Props 05 Aug

Fix available
Severity - 8.1 (High)

GHSA-279x-mwfv-vcqv

npm/@nuxt/devtools

Unauthenticated Nuxt DevTools RPC allows arbitrary command execution on the developer's host 05 Aug

Fix available
Severity - 9.6 (Critical)

GHSA-48hr-524c-v5w3

npm/nuxt

Nuxt: Unauthorized Component Instantiation via Server Island Props 05 Aug

Fix available
Severity - 4.8 (Medium)

GHSA-wm8w-6qjm-cv43

npm/nuxt

Nuxt runtime payload cache discloses another user's SSR data across users and to unauthenticated clients 05 Aug

Fix available
Severity - 7.5 (High)

GHSA-hxvh-4h3w-prp9

npm/nuxt

Nuxt route rules silently dropped for mixed-case paths, bypassing appMiddleware auth gates (incomplete fix for CVE-2026-53721) 05 Aug

Fix available
Severity - 8.2 (High)

GHSA-hxcr-hm88-mpq6

npm/nuxt

Nuxt: Unauthenticated out-of-memory crash via unbounded v-for expansion in island rendering 05 Aug

Fix available
Severity - 7.5 (High)

MAL-2026-6934

npm/load-nuxt

Malicious code in load-nuxt (npm) 07 Jul

No fix available

MAL-2026-6935

npm/load-nuxt-dev

Malicious code in load-nuxt-dev (npm) 07 Jul

No fix available

MAL-2026-6937

npm/nuxt-fonts-devtools

Malicious code in nuxt-fonts-devtools (npm) 07 Jul

No fix available

Vulnerabilities