{"action":"Upgrade nuxt to 4.6.0 or later.","affected":[{"fixed":"4.6.0","introduced":"0"}],"component":"nuxt","cve_ids":["CVE-2026-114130"],"ecosystem":"npm","exploited":false,"fixed_versions":["4.6.0"],"ghsa_id":"GHSA-jjm6-p2m9-9w4x","id":"tcs_01M5JMDFT02X4ZDB0WC66YWRR8","modified_at":"2026-10-22T17:00:04.471901983Z","published_at":"2026-10-22T16:51:37Z","references":["https://osv.dev/vulnerability/GHSA-jjm6-p2m9-9w4x","https://github.com/nuxt/nuxt/security/advisories/GHSA-jjm6-p2m9-9w4x","https://nvd.nist.gov/vuln/detail/CVE-2026-114130","https://github.com/nuxt/nuxt/pull/36459","https://github.com/nuxt/nuxt/commit/355ed9565127ff9b1453deb7160059ed55b3cb85","https://github.com/nuxt/nuxt/commit/df46569d5d3c7a7799de54c328634168fbae70bb","https://github.com/nuxt/nuxt","https://github.com/nuxt/nuxt/releases/tag/v4.6.0"],"severity":{"label":"low","score":2.3},"sources":[{"source":"osv","source_id":"GHSA-jjm6-p2m9-9w4x","url":"https://osv.dev/vulnerability/GHSA-jjm6-p2m9-9w4x"},{"source":"nvd","source_id":"CVE-2026-114130","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114130"}],"summary":"Nuxt: Incomplete fix for GHSA-934w-87qh-qr26: a `javascript:` URL prefixed with an ASCII control character executes from `<NuxtLink>` when `pages` is disabled"}