CVE-2026-56697

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-56697
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-56697.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-56697
Aliases
Published
2026-06-22T21:04:53.038Z
Modified
2026-07-08T08:26:07.961325723Z
Severity
  • 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N CVSS Calculator
Summary
Nuxt - Open Redirect via Protocol-Relative Paths in reloadNuxtApp
Details

Nuxt versions 4.0.0 before 4.4.7 and 3.x before 3.21.7 accept protocol-relative paths such as //evil.com in the reloadNuxtApp function; these pass the script-protocol check but resolve to a cross-origin URL against the current page protocol. Attackers can inject paths like //evil.com to redirect users to attacker-controlled hosts, enabling phishing and OAuth authorization-code theft.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56697.json",
    "cwe_ids": [
        "CWE-601"
    ],
    "cna_assigner": "VulnCheck"
}
References

Affected packages

Git / github.com/nuxt/nuxt

Affected ranges

Type
GIT
Repo
https://github.com/nuxt/nuxt
Events
Introduced
d991a55ec36f5ac61de0af7d0b018a150153445b
Fixed
fd806be61503f6ccad099c070a5d803777ba8a57
Introduced
8aacdde48e8388c8bb11b9a5c2f59935341bfcfd
Fixed
b7d57903b947e788fadfcfdf88be7951943731bf
Fixed
6497d99dd106254abd089f6a263d7773869a343b
Fixed
e447a793c47766834f7497f8412a76cd56fd8ee1
Database specific 
{
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ],
    "cpe": "cpe:2.3:a:nuxt:nuxt:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "3.0.0"
        },
        {
            "fixed": "3.21.7"
        },
        {
            "introduced": "4.0.0"
        },
        {
            "fixed": "4.4.7"
        }
    ]
}

Affected versions

3.*
3.1.1
v3.*
v3.0.0
v3.1.0
v3.1.1
v3.1.2
v3.10.0
v3.10.1
v3.10.2
v3.10.3
v3.11.0
v3.11.1
v3.11.2
v3.12.0
v3.12.1
v3.12.2
v3.12.3
v3.12.4
v3.13.0
v3.13.1
v3.13.2
v3.14.0
v3.14.159
v3.14.1592
v3.15.0
v3.15.1
v3.15.2
v3.15.3
v3.15.4
v3.16.0
v3.16.1
v3.16.2
v3.17.0
v3.17.1
v3.17.2
v3.17.3
v3.17.4
v3.17.5
v3.17.6
v3.17.7
v3.18.0
v3.18.1
v3.19.0
v3.19.1
v3.19.2
v3.19.3
v3.2.0
v3.2.1
v3.2.2
v3.2.3
v3.20.0
v3.20.1
v3.20.2
v3.21.0
v3.21.1
v3.21.2
v3.21.3
v3.21.4
v3.21.5
v3.21.6
v3.3.0
v3.3.1
v3.3.2
v3.3.3
v3.4.0
v3.4.1
v3.4.2
v3.4.3
v3.5.0
v3.5.1
v3.5.2
v3.5.3
v3.6.0
v3.6.1
v3.6.2
v3.6.3
v3.6.4
v3.6.5
v3.7.0
v3.7.1
v3.7.2
v3.7.3
v3.7.4
v3.8.0
v3.8.1
v3.8.2
v3.9.0
v3.9.1
v3.9.2
v3.9.3
v4.*
v4.0.0
v4.0.1
v4.0.2
v4.0.3
v4.1.0
v4.1.1
v4.1.2
v4.1.3
v4.2.0
v4.2.1
v4.2.2
v4.3.0
v4.3.1
v4.4.0
v4.4.1
v4.4.2
v4.4.3
v4.4.4
v4.4.5
v4.4.6

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-56697.json"