Vulnerability record · CVE-2026-56326 · published 22 June 2026

CVE-2026-56326: Nuxt open redirect vulnerability

Nuxt · Nuxt

Nuxt versions 4.0.0 before 4.4.7 and 3.x before 3.21.7 contain a server-side open redirect vulnerability in navigateTo that fails to properly validate path-normalized payloads like /..//evil.com and /.//evil.com. Attackers can bypass external-host checks using path-normalization techniques to redirect users to attacker-controlled sites via the Location header or meta-refresh, enabling phishing and OAuth authorization-code theft.

5.3 CVSS 4.0 Medium EPSS 0.36% · top 72.6% CWE-601 · Open redirect

5.3CVSS 4.0 base score

0.36%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

4References

25 Jun 2026Last modified by NVD

Description

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Nuxt Nuxt

References

Link	Tags
https://github.com/nuxt/nuxt/commit/1f2dd5e78c77576437138e97671965573c232835	Patch
https://github.com/nuxt/nuxt/commit/2cce6fb02e621196d56df92e05594e07469b5a6d	Patch
https://github.com/nuxt/nuxt/security/advisories/GHSA-c9cv-mq2m-ppp3	Third Party Advisory
https://www.vulncheck.com/advisories/nuxt-server-side-open-redirect-via-path-normalization-bypass-in-navigateto	Third Party Advisory

Track CVE-2026-56326 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2023-3224Nuxt code injection before 3.5.3Nuxt versions prior to 3.5.3 contain a code injection flaw (CWE-94) in the nuxt/nuxt repository. Because the injected code executes in the applicatio…EPSS 59%analysed13 Jun 2023 8.8CVE-2026-53721Nuxt incorrect authorization vulnerabilityNuxt is an open-source web development framework for Vue.js. From versions 3.11.0 to before 3.21.7 and 4.0.0 to before 4.4.7, there is a route-rule m…EPSS 0.51%12 Jun 2026 8.8CVE-2024-34344Nuxt code injection vulnerabilityNuxt is a free and open-source framework to create full-stack web applications and websites with Vue.js. Due to the insufficient validation of the `p…EPSS 0.83%5 Aug 2024 8.8CVE-2024-23657Nuxt path traversal vulnerabilityNuxt is a free and open-source framework to create full-stack web applications and websites with Vue.js. Nuxt Devtools is missing authentication on t…EPSS 1.2%5 Aug 2024 7.5CVE-2025-27415Nuxt vulnerabilityNuxt is an open-source web development framework for Vue.js. Prior to 3.16.0, by sending a crafted HTTP request to a server behind an CDN, it is poss…EPSS 0.38%19 Mar 2025 7.5CVE-2024-42352Nuxt server-side request forgery (ssrf) vulnerabilityNuxt is a free and open-source framework to create full-stack web applications and websites with Vue.js. `nuxt/icon` provides an API to allow client …EPSS 0.65%5 Aug 2024 6.8CVE-2026-56301Nuxt incorrect default permissions vulnerabilityNuxt 4.0.0 before 4.4.7 and 3.18.0 before 3.21.7, when running the development server (nuxt dev) on Linux, binds the vite-node IPC server to an abstr…EPSS 0.15%23 Jun 2026 6.3CVE-2026-47200Nuxt improper access control vulnerabilityNuxt is an open-source web development framework for Vue.js. In Nuxt versions 3.11.0 to before 3.21.6 and 4.0.0-alpha.1 to before 4.4.6 and @nuxt/nit…EPSS 0.35%12 Jun 2026

Source: NIST National Vulnerability Database (record CVE-2026-56326), CISA KEV, FIRST EPSS (scores of 2026-09-29). This page is refreshed as NVD updates the record.