Cross-Site Scripting Vulnerability in Nuxt UI by Reka UI

CVE-2026-123808

What is CVE-2026-123808?

Before version 4.8.1, the Nuxt UI library's server-rendered form component had a vulnerability that compromised user credentials. When users submitted a form before the Vue hydration process completed, the application could unintentionally perform a default GET request. This resulted in sensitive information, such as passwords, being serialized in the URL query string, potentially exposing them via the browser's address bar, history, and various logs. This critical issue has been addressed in version 4.8.1, ensuring secure handling of form submissions.

References