npm/nuxt CVE-2026-114130: low 2.3
Nuxt: Incomplete fix for GHSA-934w-87qh-qr26: a `javascript:` URL prefixed with an ASCII control character executes from `<NuxtLink>` when `pages` is disabled
Action: Upgrade nuxt to 4.6.0 or later.
npm i nuxt@4.6.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 4.6.0 | - |
Fixed versions
| 4.6.0 |
Sources
- osv: GHSA-jjm6-p2m9-9w4x
- nvd: CVE-2026-114130
- https://github.com/nuxt/nuxt/security/advisories/GHSA-jjm6-p2m9-9w4x
- https://github.com/nuxt/nuxt/pull/36459
- https://github.com/nuxt/nuxt/commit/355ed9565127ff9b1453deb7160059ed55b3cb85
- https://github.com/nuxt/nuxt/commit/df46569d5d3c7a7799de54c328634168fbae70bb
- https://github.com/nuxt/nuxt
- https://github.com/nuxt/nuxt/releases/tag/v4.6.0
CVE-2026-114130 · published · modified · JSON