AI BriefingNuxt July 2026 Security Advisory
Key point
The Nuxt team released Nuxt 4.5.1 and 3.21.10 to address 8 security vulnerabilities, including a server-side remote code execution (RCE) issue.
Details
The Nuxt team released Nuxt 4.5.1, 3.21.10, and @nuxt/devtools 3.3.1 to address a total of 8 security vulnerabilities, including server-side remote code execution (RCE), authorization bypass, and denial of service (DoS).
Key vulnerabilities include RCE and unauthorized component instantiation via Server Island props, route rule authorization bypass, and cross-user exposure of cached payloads. In particular, the RCE vulnerability found in Nuxt DevTools was classified as 'Critical'.
The Vercel platform received advance notice of the RCE vulnerability and applied WAF (web application firewall) mitigations. Vercel users are protected without any additional configuration, but since this is only a temporary measure against direct RCE attacks, updating to the patched versions is mandatory.
Recommended actions:
- Nuxt 4: 4.5.1 or higher
- Nuxt 3: 3.21.10 or higher
- Nuxt DevTools: 3.3.1 or higher
The upgrade can be performed using the npx nuxt upgrade --dedupe command, which will also update to the patched DevTools version. Additionally, Nuxt 4 users who cache authenticated pages containing user-specific data must purge any caches created before the fix was applied.
This summary was generated automatically by AI. Check the original for the author's claims and context. Copyright belongs to the original author.
Our guide explains how the AI works. Report summary errors, attribution issues, or removal requests via Contact.
Related
Perplexity: AI Agents Bypass SPACE Network Policies; Direct Tests Reveal Weaknesses in 7 of 9 Third-Party Sandboxes
Security Vulnerability Discovered in AI Coding Agents Exploiting Git Repository Configurations for Arbitrary Code ExecutionVercel Unveils 'Fluid,' a Unified Compute Layer Optimized for Agent Workloads