VulnerableCode Package Details - pkg:npm/nuxt@3.16.0

Search for packages

Vulnerability	Summary	Fixed by
VCID-m6hz-c5kh-dycw Aliases: CVE-2025-59414 GHSA-p6jq-8vc4-79f6	Nuxt has Client-Side Path Traversal in Nuxt Island Payload Revival A client-side path traversal vulnerability in Nuxt's Island payload revival mechanism allowed attackers to manipulate client-side requests to different endpoints within the same application domain when specific prerendering conditions are met.	3.19.0 Affected by 0 other vulnerabilities. 4.1.0 Affected by 0 other vulnerabilities.

Vulnerability

Summary

Fixed by

VCID-m6hz-c5kh-dycw
Aliases:
CVE-2025-59414
GHSA-p6jq-8vc4-79f6

Nuxt has Client-Side Path Traversal in Nuxt Island Payload Revival A client-side path traversal vulnerability in Nuxt's Island payload revival mechanism allowed attackers to manipulate client-side requests to different endpoints within the same application domain when specific prerendering conditions are met.

3.19.0
Affected by 0 other vulnerabilities.

4.1.0
Affected by 0 other vulnerabilities.

Vulnerability	Summary	Aliases
VCID-jctz-ddrp-g7gf	Nuxt allows DOS via cache poisoning with payload rendering response By sending a crafted HTTP request to a server behind an CDN, it is possible in some circumstances to poison the CDN cache and highly impacts the availability of a site. It is possible to craft a request, such as `https://mysite.com/?/_payload.json` which will be rendered as JSON. If the CDN in front of a Nuxt site ignores the query string when determining whether to cache a route, then this JSON response could be served to future visitors to the site.	CVE-2025-27415 GHSA-jvhm-gjrh-3h93

Vulnerability

Summary

Aliases

VCID-jctz-ddrp-g7gf

Nuxt allows DOS via cache poisoning with payload rendering response By sending a crafted HTTP request to a server behind an CDN, it is possible in some circumstances to poison the CDN cache and highly impacts the availability of a site. It is possible to craft a request, such as `https://mysite.com/?/_payload.json` which will be rendered as JSON. If the CDN in front of a Nuxt site ignores the query string when determining whether to cache a route, then this JSON response could be served to future visitors to the site.

CVE-2025-27415
GHSA-jvhm-gjrh-3h93

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-06-09T20:43:24.362324+00:00	GHSA Importer	Fixing	VCID-jctz-ddrp-g7gf	https://github.com/advisories/GHSA-jvhm-gjrh-3h93	38.6.0
2026-06-06T06:08:55.455012+00:00	GitLab Importer	Affected by	VCID-m6hz-c5kh-dycw	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/nuxt/CVE-2025-59414.yml	38.6.0
2026-06-04T17:12:09.590250+00:00	GithubOSV Importer	Fixing	VCID-jctz-ddrp-g7gf	https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/03/GHSA-jvhm-gjrh-3h93/GHSA-jvhm-gjrh-3h93.json	38.6.0
2026-06-04T16:23:32.618500+00:00	GitLab Importer	Fixing	VCID-jctz-ddrp-g7gf	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/nuxt/CVE-2025-27415.yml	38.6.0