Security Flaw in Nuxt Framework Affects JavaScript Rendering for Vue.js

CVE-2026-114130

What is CVE-2026-114130?

The Nuxt framework, specifically versions prior to 4.6.0, has a vulnerability where an incomplete fix allows an application with disabled pages to render scripts through NuxtLink when specific attacker-controlled inputs are used. This occurs when an ASCII C0 control character prefixes the input, causing the no-pages router to incorrectly classify it as an internal route. As a result, the compromised value is processed and rendered in the anchor href, leading to potential script execution in a victim's browser when they click the link. This risk is mitigated in version 4.6.0.

References