Client-Side Path Traversal Vulnerability in Nuxt Framework by Nuxt Technologies

CVE-2025-59414

What is CVE-2025-59414?

A client-side path traversal vulnerability exists in Nuxt, an open-source web development framework for Vue.js. This vulnerability allows attackers to exploit the Island payload revival mechanism, manipulating client-side requests to unintended endpoints within the application domain under specific prerendering conditions. The issue arises in the revive-payload client process, where user-controlled data can lead to serialized __nuxt_island objects stored in the prerendered pages. As a result, attackers can inject crafted paths into these serialized objects, enabling unauthorized access to sensitive content. Users are recommended to update to Nuxt version 3.19.0 or higher, or 4.1.0 or higher to mitigate this vulnerability.

References