CVE-2026-56326 json
Nuxt - Server-Side Open Redirect via Path-Normalization Bypass in navigateTo
published 5mo ago modified 17d ago also CVE-2026-56697 , CVE-2026-56698 , EUVD-2026-38375 , GHSA-c9cv-mq2m-ppp3
- cvss
- 6.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 30%
- public exploits
- 0
- none known
Summary
Nuxt versions 4.0.0 before 4.4.7 and 3.x before 3.21.7 contain a server-side open redirect vulnerability in navigateTo that fails to properly validate path-normalized payloads like /..//evil.com and /.//evil.com. Attackers can bypass external-host checks using path-normalization techniques to redirect users to attacker-controlled sites via the Location header or meta-refresh, enabling phishing and OAuth authorization-code theft.
Patch / fix
- npm nuxt 3.21.7, 4.4.7
- Nuxt Nuxt 3.21.7, 4.4.7
- github.com/nuxt/nuxt@2cce6fb commit
- github.com/nuxt/nuxt@1f2dd5e commit
- github.com/nuxt/nuxt@3394716 commit
- github.com/nuxt/nuxt@62fc32e commit
- github.com/nuxt/nuxt@6497d99 commit
- github.com/nuxt/nuxt@e447a79 commit
- github.com/nuxt/nuxt#35115 pull request
- github.com/nuxt/nuxt#35206 pull request
Is CVE-2026-56326 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 4mo ago
Exploit prediction
0.36% chance of exploitation in the next 30 days, higher than 30% of all scored CVEs (FIRST EPSS, 2026-11-11).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 5.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N |
| CNA | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| GitHub | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| CNA | 4.0 | 5.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | nuxt | >=4.0.0, <4.4.7 >=3.5.0, <3.21.7 |
4.4.7 3.21.7 |
Affected products
- Nuxt Nuxt
Classification
References
-
github.com
/nuxt/nuxt/commit/2cce6fb02e621196d56df92e05594e07469b5a6d
patch, web
-
github.com
/nuxt/nuxt/commit/1f2dd5e78c77576437138e97671965573c232835
patch, web
-
github.com
/nuxt/nuxt/pull/35115
web
-
github.com
/nuxt/nuxt/pull/35206
web
-
github.com
/nuxt/nuxt/commit/3394716d4a913cba904b028df5338f2aead50032
web
-
github.com
/nuxt/nuxt/commit/62fc32eddf648b00a3890141e0235d2a222b024d
web
-
github.com
/nuxt/nuxt/commit/6497d99dd106254abd089f6a263d7773869a343b
web
-
github.com
/nuxt/nuxt/commit/e447a793c47766834f7497f8412a76cd56fd8ee1
web
-
github.com
/nuxt/nuxt/security/advisories/GHSA-c9cv-mq2m-ppp3
vendor-advisory, web, third-party-advisory, advisory
-
vulncheck.com
/advisories/nuxt-server-side-open-redirect-via-path-normalization-bypass-in-navigateto
third-party-advisory, web
-
nvd.nist.gov
/vuln/detail/CVE-2026-56326
advisory
-
nvd.nist.gov
/vuln/detail/CVE-2026-56697
advisory
-
nvd.nist.gov
/vuln/detail/CVE-2026-56698
advisory
-
github.com
/nuxt/nuxt
package
-
vulncheck.com
/advisories/nuxt-cross-site-scripting-via-navigateto-open-option
web
-
vulncheck.com
/advisories/nuxt-open-redirect-via-protocol-relative-paths-in-reloadnuxtapp
web
Sources
- CVE List CVE-2026-56326
- GitHub Advisory GHSA-c9cv-mq2m-ppp3
- NVD CVE-2026-56326
- Maintainer advisory GHSA-c9cv-mq2m-ppp3
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
The maintainers of nuxt/nuxt published their own advisory on GitHub. Reviewed sources take precedence over it.