Socket releases free Certified Patches for high-severity Nuxt vulnerabilities, including server-side remote code execution through server island props.
Nuxt has released security updates for multiple vulnerabilities affecting Nuxt 3.x and 4.x, along with a separate critical development-only vulnerability in @nuxt/devtools.
Nuxt 4.5.1 and 3.21.10 address issues including server-side remote code execution, authorization bypass, denial of service, and cross-user payload disclosure. @nuxt/devtools 3.3.1 fixes a critical remote code execution vulnerability affecting development servers.
Socket has published Certified Patches for two of the disclosed Nuxt advisories and is preparing patches for the remaining issues. Certified Patches for Critical and High severity vulnerabilities are free to use, including for teams that are not Socket customers.
The Nuxt release addresses eight GitHub Security Advisories across Nuxt and Nuxt DevTools.
The most serious production issue, GHSA-9473-5f9j-94wq, can enable server-side remote code execution through server island props. It requires vue.runtimeCompiler to be enabled, which is off by default, along with an application pattern where attacker-controlled island props reach Vue’s dynamic component resolution.
A related vulnerability, GHSA-48hr-524c-v5w3, can allow unauthorized instantiation of HTML elements or globally registered components through server island props. It does not enable code execution, but it can affect applications using polymorphic component patterns or Vue attribute fallthrough.
Other fixes address:
A route-rule authorization bypass when appMiddleware is used with route rules containing uppercase characters
Two denial-of-service issues affecting server components and islands
Cross-user disclosure of cached Nuxt payloads on authenticated pages in Nuxt 4.x
A development-server path disclosure issue
Critical remote code execution in Nuxt DevTools when running nuxt dev with DevTools enabled
The DevTools issue affects development environments, not production deployments. It can be reached by another process on the host, users on the local network when the dev server is exposed with --host, or a malicious site visited while the dev server is running.
Nuxt recommends upgrading to Nuxt 4.5.1 or 3.21.10:
npx nuxt upgrade --dedupe
Refresh your lockfile as part of the upgrade to ensure it resolves @nuxt/devtools@3.3.1 or later.
Teams using authenticated pages with Nuxt cache, swr, or isr route rules should also purge CDN and edge caches after upgrading. Previously cached _payload.json responses may remain available until explicitly evicted.
Socket has published a free Certified Patch for GHSA-9473-5f9j-94wq, the high-severity server-side remote code execution issue involving server island props.
Apply it with:
socket patch add GHSA-9473-5f9j-94wq
You can also view the Certified Patch for an affected version here.
Socket has also published a Certified Patch for GHSA-48hr-524c-v5w3, which addresses unauthorized component instantiation through server island props:
socket patch add GHSA-48hr-524c-v5w3
A patch for an affected version is available here.
Certified Patches apply a minimal, reviewed change directly to vulnerable package versions while preserving the rest of the package’s behavior. They allow teams to remediate an issue without waiting on a full dependency upgrade or dependency-tree refactor.
We are preparing Certified Patches for the remaining Nuxt advisories and will update this post as they are completed. Once all patches are available, Socket’s merged patches will provide a consolidated way to remediate the full set of disclosed Nuxt vulnerabilities.