CVE-2026-114130

Nuxt is an open-source web development framework for Vue.js. Prior to 4.6.0, an incomplete fix for CVE-2026-53722 allows an application with pages disabled to render a script-capable URL through NuxtLink when attacker-controlled input bound to to is prefixed with an ASCII C0 control character. The no-pages router classifies the value as an internal route before the earlier protocol check and passes it to the rendered anchor href; browsers remove the leading control character and interpret the remaining javascript: URL. The default anchor and NuxtLink custom output are affected, the unsafe href is present in server-rendered HTML, and a victim must click the link for script to execute in the application's origin. This issue is fixed in version 4.6.0.

• CWE-79

• https://github.com/nuxt/nuxt/commit/355ed9565127ff9b1453deb7160059ed55b3cb85
• https://github.com/nuxt/nuxt/commit/df46569d5d3c7a7799de54c328634168fbae70bb
• https://github.com/nuxt/nuxt/pull/36459
• https://github.com/nuxt/nuxt/releases/tag/v4.6.0
• https://github.com/nuxt/nuxt/security/advisories/GHSA-jjm6-p2m9-9w4x

Published

Oct 21, 2026

Last Modified

Oct 22, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-114125Storybook is a frontend workshop for building user interface…8.6
• CVE-2026-114126Storybook is a frontend workshop for building user interface…8.7
• CVE-2026-114127Astro is a web framework for content-driven websites. From 7…2.3
• CVE-2026-114128Astro is a web framework for content-driven websites. Prior …6.5
• CVE-2026-114129stream-json is a micro-library of stream components for proc…6.2
• CVE-2026-11413A security vulnerability has been detected in JingDong JD Cl…8.8
• CVE-2026-114131Nuxt is an open-source web development framework for Vue.js.…6.5
• CVE-2026-114132Nuxt is an open-source web development framework for Vue.js.…6.3
• CVE-2026-114133Nuxt is an open-source web development framework for Vue.js.…5.4
• CVE-2026-114135Jupyter Server is the backend for Jupyter web applications. …8.8
• CVE-2026-114136Django REST framework is a toolkit for building Web APIs. Fr…7.5
• CVE-2026-114137Django REST framework is a toolkit for building Web APIs. Fr…7.4