Nuxt July 2026 security release — 7 advisories including server-side RCE via Server Island prop injection and a critical DevTools RCE

TL;DR

Nuxt shipped a coordinated 7-advisory security release on 2026-07-27 (patched in Nuxt 4.5.1 / 3.21.10, plus @nuxt/devtools 3.3.1), headlined by GHSA-9473-5f9j-94wq — a server-side remote code execution in Nuxt's "Server Island" feature: if vue.runtimeCompiler: true is enabled and a server island component forwards attacker-controlled props into Vue's dynamic component resolution (<component :is>, resolveDynamicComponent, h() — a common pattern in @nuxt/ui-based apps), an attacker can inject a template key that Vue's runtime compiler executes on the server. The batch also includes a critical, dev-only DevTools RCE (GHSA-279x-mwfv-vcqv) and a route-rule authorization bypass (GHSA-hxvh-4h3w-prp9). Upgrade with npx nuxt upgrade --dedupe.

What happened

Nuxt's own security post (nuxt.com/blog/v4-5-security, published 2026-07-27) discloses seven advisories together:

No CVE numbers had been assigned to any of these as of the original 2026-07-27 sweep; all were tracked by GHSA ID only at that time. Vercel received advance notice and deployed platform-wide WAF mitigations for apps hosted on Vercel ahead of public disclosure (Vercel changelog); Netlify also published guidance for its users (Netlify changelog). Socket.dev additionally released free backport patches for older Nuxt release lines that won't receive an official fix.

Update (2026-08-05) — CVE numbers assigned to the same July batch, plus one companion advisory clarifying an earlier incomplete fix. MITRE/NVD formally assigned CVE numbers to this same 7-advisory batch on 2026-08-05, fixed in the same 3.21.10 / 4.5.1 release as the original disclosure (no new patch was needed — these are retroactive CVE-ID assignments, not a second release): - CVE-2026-71320 = GHSA-9473-5f9j-94wq (the headline Server Island RCE) - CVE-2026-71318 = GHSA-48hr-524c-v5w3 (unauthorized component instantiation) - CVE-2026-71316 = GHSA-wm8w-6qjm-cv43 (cross-user SSR payload disclosure) - CVE-2026-71314 and CVE-2026-71321 = the two server-component DoS advisories (unbounded v-for expansion causing OOM; unauthenticated CPU exhaustion from parsing/hashing the island endpoint body before hash validation) - CVE-2026-71315 (GHSA-mm7m-92g8-7m47 territory) is a distinct, related advisory: Nuxt's route-rule matching lowercases the lookup path but not the route-rule key, so a mixed-case routeRules entry silently fails to match and drops its appMiddleware authorization gate — described as an incomplete fix for an earlier, separate CVE (CVE-2026-53721) not previously tracked in this repo. Affected 3.21.7–3.21.9 and 4.4.7–4.5.0; fixed in the same 3.21.10 / 4.5.1 release as the rest of this batch. If you protect any route via routeRules + appMiddleware with a mixed-case path segment (e.g. /Admin/**), confirm you're on ≥3.21.10/4.5.1 — this is the kind of case-sensitivity gap that's easy to miss in a routine version bump.

Am I affected?

grep -E '"nuxt":' package.json
npm ls nuxt @nuxt/devtools 2>/dev/null

• Nuxt 3.4.0–3.21.9 or 4.0.0–4.5.0, with vue.runtimeCompiler: true set and any server island/component forwarding untrusted props into dynamic component resolution (especially via @nuxt/ui's polymorphic as/asChild props): exposed to the RCE (GHSA-9473-5f9j-94wq).
• Same version range regardless of the runtime-compiler setting: exposed to the lower-severity component-instantiation issue (GHSA-48hr-524c-v5w3).
• Any @nuxt/devtools version, in development only: exposed to the critical DevTools RCE (GHSA-279x-mwfv-vcqv) — not a production-facing risk, but treat any exposed dev server as untrusted until patched.

If you are affected

1. Upgrade: npx nuxt upgrade --dedupe to reach Nuxt 4.5.1 / 3.21.10, and update @nuxt/devtools to 3.3.1.
2. If you're on Nuxt ≥4.4.0, purge any CDN/edge cache that may hold a leaked _payload.json after upgrading (per Nuxt's own remediation guidance for GHSA-wm8w-6qjm-cv43).
3. If you can't upgrade immediately, disable vue.runtimeCompiler if you don't need it, and check Socket's backport patches for your release line.
4. See playbooks/if-your-webapp-was-compromised.md if you find evidence of exploitation predating your patch.

Prevention

→ prevention/supply-chain-attack-surface.md → Treat any framework feature that forwards request-controlled data into a template/dynamic-component-resolution API as a code-execution boundary, not a rendering convenience — the same "decorator/annotation-as-documentation" lesson this repo tracks elsewhere applies to <component :is>/resolveDynamicComponent accepting untrusted input. → Subscribe to nuxt.com/blog if you run Nuxt in production, the same way this repo already recommends for Next.js's monthly security-release cadence.

Why this matters for vibe coders

Nuxt (and its companion @nuxt/ui component library) is a major Vue-based alternative to Next.js/React for AI-assisted app scaffolding, and Server Islands are exactly the kind of feature a vibe-coded app is likely to adopt via a copy-pasted example without understanding the vue.runtimeCompiler precondition. The DevTools RCE is also a reminder that dev-only tooling shipped alongside a framework is still part of its attack surface if a dev server is ever exposed beyond localhost.

Sources

• Nuxt — "Nuxt Security Patch Releases" (v4.5 security post) — primary vendor disclosure, published 2026-07-27: full advisory table, severities, affected/fixed versions, remediation guidance.
• GitHub Security Advisory — GHSA-9473-5f9j-94wq — canonical advisory for the headline RCE: CVSS 8.1, exact preconditions, affected version ranges.
• GitHub Security Advisory — GHSA-48hr-524c-v5w3 — companion advisory: CVSS 4.8, confirms no runtime-compiler precondition needed.
• Vercel — Nuxt July 2026 security advisory — independent corroboration from a hosting platform that received advance notice and deployed WAF mitigations.