CVE-2026-128075

Nuxt is an open-source web development framework for Vue.js. From 3.0.0 until 4.6.4, Nuxt wraps non-HTTP errors thrown during server rendering with createError and incorrectly treats the result as an error deliberately exposed by the application. In production, the error page payload (__NUXT_DATA__) and JSON error response can therefore disclose the original message and data, including an upstream $fetch URL, query-string secrets, response bodies, database hosts, or similar sensitive details, regardless of what a custom error.vue renders. Errors deliberately created with createError or showError, errors returned by useFetch or useAsyncData, and server/api routes are not affected because their client-visible behavior is intentional or follows a different path. This issue is fixed in version 4.6.4.

• CWE-209

• https://github.com/nuxt/nuxt/commit/8c56b71e4d0377c5c047799078db09c6b3d4fde5
• https://github.com/nuxt/nuxt/releases/tag/v4.6.4
• https://github.com/nuxt/nuxt/security/advisories/GHSA-96x6-fvhx-49hg

Published

Nov 13, 2026

Last Modified

Nov 13, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-128069rails-html-sanitizer is responsible for sanitizing HTML frag…4.7
• CVE-2026-12807A vulnerability was found in Edimax BR-6478AC V2 1.23. This …6.3
• CVE-2026-128070Nuxt is an open-source web development framework for Vue.js.…5.9
• CVE-2026-128071Nuxt is an open-source web development framework for Vue.js.…6.5
• CVE-2026-128072Nuxt is an open-source web development framework for Vue.js.…3.1
• CVE-2026-128074Nuxt is an open-source web development framework for Vue.js.…6.9
• CVE-2026-128076Nuxt is an open-source web development framework for Vue.js.…3.1
• CVE-2026-128077Nuxt is an open-source web development framework for Vue.js.…6.5
• CVE-2026-128078GLPI is a free asset and IT management software package. Fro…5.3
• CVE-2026-128079envd provides reproducible development environments for huma…6.8
• CVE-2026-12808A vulnerability was determined in Edimax BR-6478AC V2 1.23. …6.3
• CVE-2026-128080OpenTelemetry JavaScript is the OpenTelemetry JavaScript cli…5.8