CVE-2026-56326

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-56326
Nuxt versions 4.0.0 before 4.4.7 and 3.x before 3.21.7 contain a server-side open redirect vulnerability in navigateTo that fails to properly validate path-normalized payloads like /..//evil.com and /.//evil.com. Attackers can bypass external-host checks using path-normalization techniques to redirect users to attacker-controlled sites via the Location header or meta-refresh, enabling phishing and OAuth authorization-code theft.

6.1 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://github.com/nuxt/nuxt/commit/1f2dd5e78c77576437138e97671965573c232835 Patch
https://github.com/nuxt/nuxt/commit/2cce6fb02e621196d56df92e05594e07469b5a6d Patch
https://github.com/nuxt/nuxt/security/advisories/GHSA-c9cv-mq2m-ppp3 Third Party Advisory
https://www.vulncheck.com/advisories/nuxt-server-side-open-redirect-via-path-normalization-bypass-in-navigateto Third Party Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:nuxt:nuxt:*:*:*:*:*:*:*:*
cpe:2.3:a:nuxt:nuxt:*:*:*:*:*:*:*:*
History

25 Jun 2026, 16:51

Type Values Removed Values Added
CPE cpe:2.3:a:nuxt:nuxt:*:*:*:*:*:*:*:*
First Time Nuxt nuxt
Nuxt
References () https://github.com/nuxt/nuxt/commit/1f2dd5e78c77576437138e97671965573c232835 - () https://github.com/nuxt/nuxt/commit/1f2dd5e78c77576437138e97671965573c232835 - Patch
References () https://github.com/nuxt/nuxt/commit/2cce6fb02e621196d56df92e05594e07469b5a6d - () https://github.com/nuxt/nuxt/commit/2cce6fb02e621196d56df92e05594e07469b5a6d - Patch
References () https://github.com/nuxt/nuxt/security/advisories/GHSA-c9cv-mq2m-ppp3 - () https://github.com/nuxt/nuxt/security/advisories/GHSA-c9cv-mq2m-ppp3 - Third Party Advisory
References () https://www.vulncheck.com/advisories/nuxt-server-side-open-redirect-via-path-normalization-bypass-in-navigateto - () https://www.vulncheck.com/advisories/nuxt-server-side-open-redirect-via-path-normalization-bypass-in-navigateto - Third Party Advisory

22 Jun 2026, 22:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-06-22 22:16

Updated : 2026-06-25 16:51

NVD link : CVE-2026-56326

Mitre link : CVE-2026-56326

CVE.ORG link : CVE-2026-56326

JSON object : View

Products Affected

nuxt

  • nuxt
CWE
CWE-601

URL Redirection to Untrusted Site ('Open Redirect')