# Nuxt July 2026 security advisory

DevFeed: [Nuxt July 2026 security advisory](<https://devfeed.tech/articles/nuxt-july-2026-security-advisory-1033.md>)

Original publisher: [Read original article](<https://vercel.com/changelog/nuxt-july-2026-security-advisory>)

Author: Sage Abraham

Published: 2026-07-27T00:00:00Z

Content type: article

Language: en

Sources: [Vercel News](<https://devfeed.tech/sources/vercel-news.md>)

Topics: [Nuxt.js](<https://devfeed.tech/topics/nuxt.md>), [Security](<https://devfeed.tech/topics/security.md>), [Vulnerabilities](<https://devfeed.tech/topics/vulnerabilities.md>), [Authorization](<https://devfeed.tech/topics/authorization.md>), [Caching](<https://devfeed.tech/topics/caching.md>), [Vercel](<https://devfeed.tech/topics/vercel.md>)

Tags: [authorization](<https://devfeed.tech/tags/authorization.md>), [cache](<https://devfeed.tech/tags/cache.md>), [caching](<https://devfeed.tech/tags/caching.md>), [cve](<https://devfeed.tech/tags/cve.md>), [development](<https://devfeed.tech/tags/development.md>), [nuxt](<https://devfeed.tech/tags/nuxt.md>), [remote-code-execution](<https://devfeed.tech/tags/remote-code-execution.md>), [security](<https://devfeed.tech/tags/security.md>), [upgrade](<https://devfeed.tech/tags/upgrade.md>), [vercel](<https://devfeed.tech/tags/vercel.md>), [vulnerabilities](<https://devfeed.tech/tags/vulnerabilities.md>)

## AI overview

The Nuxt team released Nuxt 4.5.1, Nuxt 3.21.10, and @nuxt/devtools 3.3.1 to fix eight security advisories, including a high-severity server-side remote code execution vulnerability. Vercel deployed WAF mitigations for direct exploitation of that vulnerability, but users must still upgrade because other issues affect component instantiation, caching, authorization, denial of service, and development tooling.

## Source excerpt

The Nuxt team has released Nuxt 4.5.1 and 3.21.10, along with @nuxt/devtools 3.3.1, to address eight security advisories, including a high-severity server-side remote code execution vulnerability. Vulnerabilities addressed Vulnerability Severity Advisory Server-side remote code execution via server island props High GHSA-9473-5f9j-94wq Unauthorized component instantiation via server island props Medium GHSA-48hr-524c-v5w3 Route rule authorization bypass High GHSA-hxvh-4h3w-prp9 Server component denial of service High GHSA-hxcr-hm88-mpq6, GHSA-9pgf-384g-p7mv Cross-user disclosure of cached payloads, affecting Nuxt 4.x versions 4.4.0 and later High GHSA-wm8w-6qjm-cv43 Development server path disclosure Low GHSA-7c4v-fwgw-9rf7 Remote code execution in Nuxt DevTools, development-only, fixed in @nuxt/devtools 3.3.1 Critical GHSA-279x-mwfv-vcqv Vercel platform protections Vercel received advance notice of the server-side remote code execution vulnerability, GHSA-9473-5f9j-94wq, and deployed platform-wide WAF mitigations before public disclosure. Applications deployed on Vercel are automatically protected by these mitigations, with no configuration changes required. However, do not rely on them for full protection. Upgrading to a patched version is still required. The WAF mitigations cover only direct exploitation of the server-side RCE. The remaining component-instantiation, caching, authorization, denial-of-service, and development-time vulnerabilities require upgrading Nuxt and Nuxt DevTools. Recommended action All Nuxt users should upgrade as soon as possible: Nuxt 4: 4.5.1 or later Nuxt 3: 3.21.10 or later Nuxt DevTools: 3.3.1 or later To upgrade, run: This also refreshes the lockfile, pulling in the patched Nuxt DevTools version. Users who previously upgraded for the earlier route rule advisory, CVE-2026-53721, must still upgrade. The newly disclosed authorization bypass is a regression in that earlier fix. Nuxt 4 users who cache authenticated pages containing user-s