Netlify Warns of Critical Nuxt Security Vulnerabilities Requiring Immediate Framework Upgrades.

The Nuxt team has disclosed four security vulnerabilities, including a critical route middleware bypass that affects all Nuxt applications using .server.vue pages with middleware-only authentication, regardless of hosting provider.

Netlify published detailed guidance on May 19, breaking down each CVE's impact on its platform and strongly recommending developers upgrade to Nuxt 3.21.6 or 4.4.6 immediately.

CVE-2026-47200, the most severe of the four vulnerabilities, allows attackers to bypass route middleware entirely when component islands are enabled. In Nuxt 4, islands are the default; in Nuxt 3, they're available via opt-in flag.

The vulnerability works by exposing .server.vue page files through /__nuxt_island/page_* endpoints that render pages without invoking Vue Router. Any page protected solely by route middleware, without server-side authentication checks, becomes accessible to unauthenticated users.

This issue affects all hosting providers. Applications relying on middleware-only authentication for sensitive pages are vulnerable until they upgrade.

CVE-2026-46342 involves island endpoints accepting props via query parameters without server-side hash validation, potentially allowing cache poisoning attacks. According to Netlify's analysis, this vulnerability has limited impact on standard Netlify deployments due to the platform's caching architecture.

The company notes that while the flaw exists at the framework level, Netlify's edge configuration mitigates most exploitation vectors for typical production sites.

Two additional CVEs round out the disclosure:

• CVE-2026-45670 exposes built source code over LAN during development, a risk primarily relevant to local development environments rather than production deployments
• CVE-2026-45669 enables reflected XSS via navigateTo with external: true, requiring user interaction but potentially allowing attackers to execute malicious scripts

Netlify characterizes the development server vulnerability as having minimal production impact, since it only affects local environments. The XSS flaw, while serious, requires specific application code patterns to be exploitable.

The Nuxt team released patched versions on May 19. Affected applications should upgrade to:

• Nuxt 3.21.6 (for 3.x users)
• Nuxt 4.4.6 (for 4.x users)

Netlify's changelog entry includes a complete breakdown of each CVE with version ranges, severity assessments, and specific guidance for Netlify customers. The company emphasizes that two vulnerabilities require immediate framework upgrades regardless of hosting provider.

This follows Netlify's pattern of proactive security communication, similar to their guidance during earlier Next.js and React vulnerability disclosures. The platform continues to position security transparency as a core value proposition for teams building production applications.