Nuxt security posture
Review linked rules in the directory and use Composer to export guardrails for your IDE. Detailed posture metrics will appear here as the catalog grows.
2 linked rules in the directory.
Top risks for this stack
00 critical05 high
Nuxt dev server discloses project root and workspace UUID via the Chrome DevTools workspace endpointMEDIUM
Aug 2026
No rule coverage yet — consider contributing a rule.
Nuxt: Unauthenticated CPU exhaustion parsing and hashing the Nuxt island endpoint body before hash validationHIGH
Aug 2026
No rule coverage yet — consider contributing a rule.
Nuxt: Server-Side Remote Code Execution via Runtime Template Injection in Nuxt Server Island PropsHIGH
Aug 2026
No rule coverage yet — consider contributing a rule.
Nuxt: Unauthorized Component Instantiation via Server Island PropsMEDIUM
Aug 2026
No rule coverage yet — consider contributing a rule.
Nuxt runtime payload cache discloses another user's SSR data across users and to unauthenticated clientsHIGH
Aug 2026
No rule coverage yet — consider contributing a rule.
Nuxt route rules silently dropped for mixed-case paths, bypassing appMiddleware auth gates (incomplete fix for CVE-2026-53721)HIGH
Aug 2026
No rule coverage yet — consider contributing a rule.
Nuxt: Unauthenticated out-of-memory crash via unbounded v-for expansion in island renderingHIGH
Aug 2026
No rule coverage yet — consider contributing a rule.
Nuxt dev server vite-node IPC socket is world-connectable on LinuxMEDIUM
Jun 2026
No rule coverage yet — consider contributing a rule.