Socket Releases Free Certified Patches for Nuxt Security Vulnerabilities

Security News /Company News Socket Is Sponsoring Composer and Packagist Socket has joined the new Composer and Packagist sponsorship program as a launch sponsor, supporting the team that keeps PHP's package ecosystem secure. Socket releases free Certified Patches for high-severity Nuxt vulnerabilities, including server-side remote code execution through server island props. July 27, 2026 3 min read Nuxt has released security updates for multiple vulnerabilities affecting Nuxt 3.x and 4.x, along with a separate critical development-only vulnerability in @nuxt/devtools . Nuxt 4.5.1 and 3.21.10 address issues including server-side remote code execution, authorization bypass, denial of service, and cross-user payload disclosure. @nuxt/devtools 3.3.1 fixes a critical remote code execution vulnerability affecting development servers. Socket has published Certified Patches for two of the disclosed Nuxt advisories and is preparing patches for the remaining issues. Certified Patches for Critical and High severity vulnerabilities are free to use, including for teams that are not Socket customers. The Nuxt release addresses eight GitHub Security Advisories across Nuxt and Nuxt DevTools. The most serious production issue, GHSA-9473-5f9j-94wq, can enable server-side remote code execution through server island props. It requires vue.runtimeCompiler to be enabled, which is off by default, along with an application pattern where attacker-controlled island props reach Vue’s dynamic component resolution. A related vulnerability, GHSA-48hr-524c-v5w3, can allow unauthorized instantiation of HTML elements or globally registered components through server island props. It does not enable code execution, but it can affect applications using polymorphic component patterns or Vue attribute fallthrough. Other fixes address: appMiddleware is used with route rules containing uppercase charactersnuxt dev with DevTools enabledThe DevTools issue affects development environments, not production deployments. It can be reached by another process on the host, users on the local network when the dev server is exposed with --host , or a malicious site visited while the dev server is running. Nuxt recommends upgrading to Nuxt 4.5.1 or 3.21.10: npx nuxt upgrade --dedupe Refresh your lockfile as part of the upgrade to ensure it resolves @nuxt/devtools@3.3.1 or later. Teams using authenticated pages with Nuxt cache , swr , or isr route rules should also purge CDN and edge caches after upgrading. Previously cached _payload.json responses may remain available until explicitly evicted. Socket has published a free Certified Patch for GHSA-9473-5f9j-94wq, the high-severity server-side remote code execution issue involving server island props. Apply it with: socket patch add GHSA-9473-5f9j-94wq You can also view the Certified Patch for an affected version here. Socket has also published a Certified Patch for GHSA-48hr-524c-v5w3, which addresses unauthorized component instantiation through server island props: socket patch add GHSA-48hr-524c-v5w3 A patch for an affected version is available here. Certified Patches apply a minimal, reviewed change directly to vulnerable package versions while preserving the rest of the package’s behavior. They allow teams to remediate an issue without waiting on a full dependency upgrade or dependency-tree refactor. We are preparing Certified Patches for the remaining Nuxt advisories and will update this post as they are completed. Once all patches are available, Socket’s merged patches will provide a consolidated way to remediate the full set of disclosed Nuxt vulnerabilities. Organizations using Nuxt should: @nuxt/devtools to 3.3.1 or later and refresh lockfiles.cache , swr , or isr route rules.appMiddleware protects routes whose route-rule keys include uppercase characters.Subscribe to our newsletter Get notified when we publish new security blog posts! Security News /Company News Socket has joined the new Composer and Packagist sponsorship program as a launch sponsor, supporting the team that keeps PHP's package ecosystem secure. Research /Security News Benign-looking npm packages split malicious functionality across a dependency chain that deploys a cross-platform RAT targeting Alibaba developers. Research /Security News Two Joyfill npm beta releases contain an import-time implant that uses blockchain transactions to retrieve a remote-access trojan.