CVE-2025-59414: Nuxt Client-Side Path Traversal Vulnerability in Island Payload Revival
Summary
CVE-2025-59414: Nuxt has Client-Side Path Traversal in Nuxt Island Payload Revival. Affects nuxt across 2 version ranges.
>= 3.6.0, < 3.19.0
>= 4.0.0, < 4.1.0
Fixed in 3.19.0 or 4.1.0, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Nuxt is a popular open-source framework for building server-side rendered applications using Vue.js. It provides features like automatic code splitting, server-side rendering, and static site generation. However, a vulnerability has been identified in its Island payload revival mechanism, which can lead to client-side path traversal attacks under specific conditions.
Vulnerability Detail
A client-side path traversal vulnerability exists in Nuxt's Island payload revival process. This issue arises when user-controlled data is returned from an API endpoint during prerendering, allowing attackers to manipulate client-side requests to different endpoints within the same application domain. The vulnerability is triggered when the __nuxt_island object is serialized and deserialized, potentially leading to unauthorized access to internal services if path traversal sequences are not properly handled.
How To Fix
Latest published version: 4.6.2 as of 22 Oct 2026
npm install nuxt@4.6.2Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 3.6.0, < 3.19.03.19.0npm install nuxt@3.19.0 -
>= 4.0.0, < 4.1.04.1.0npm install nuxt@4.1.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If an immediate update is not possible, consider the following workarounds: 1. Disable prerendering for pages that fetch user-controlled data. 2. Implement strict input validation on API endpoints used during prerendering. 3. Use allowlists for API response structures during prerendering.
Conclusion
The CVE-2025-59414 vulnerability in Nuxt poses a risk of client-side path traversal under specific conditions. It is crucial to update to the patched versions or implement workarounds to mitigate potential exploitation. Regular monitoring and validation of API responses are recommended to maintain application security.
See every vulnerability recorded for nuxt →
FAQ
CVE-2025-59414 is a vulnerability in Nuxt that allows client-side path traversal through the Island payload revival mechanism.
The prerequisites include using prerendered pages, having attacker-controlled API responses, and requiring client-side navigation to the affected page.
The CVSS score for this vulnerability is 3.1, indicating a low severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you cannot update immediately, consider disabling prerendering for affected pages and implementing strict validation on API responses.
References
Related vulnerabilities
Recent vulnerabilities recorded for nuxt.
