Information Disclosure in Nuxt Framework by Nuxt.js
CVE-2026-128075

5.3MEDIUM

Key Information:

Vendor

Nuxt

Status
Nuxt
Vendor
CVE Published:
13 November 2026

What is CVE-2026-128075?

Nuxt, an open-source web development framework for Vue.js, exposes sensitive information due to incorrect error handling during server rendering. From versions 3.0.0 to 4.6.4, non-HTTP errors wrapped with createError may inadvertently disclose original error messages and data when rendered in production. This can reveal sensitive details, such as upstream $fetch URLs, query-string secrets, and database hosts, even with custom error handling in place. The issue is resolved in version 4.6.4.

Affected Version(s)

nuxt >= 3.0.0, < 4.6.4

References

https://github.com/nuxt/nuxt/security/advisories/GHSA-96x...
x_refsource_CONFIRM
https://github.com/nuxt/nuxt/commit/8c56b71e4d0377c5c0477...
x_refsource_MISC
https://github.com/nuxt/nuxt/releases/tag/v4.6.4
x_refsource_MISC

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.