CVE-2026-114130

Nuxt: Incomplete fix for GHSA-934w-87qh-qr26: a `javascript:` URL prefixed with an ASCII control character executes from `<NuxtLink>` when `pages` is disabled

LOW

2.3

CVSS Score

Published: October 21, 2026 at 05:37 PM UTC

Updated: October 28, 2026 at 02:17 AM UTC

1 product affected across 1 vendorNuxt

Using nuxt by nuxt?

Get instant alerts when new vulnerabilities affect nuxt - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

LOW2.3

Exploit prediction

EPSS 0.4%

SSVC

No known exploit

Description

Nuxt is an open-source web development framework for Vue.js. Prior to 4.6.0, an incomplete fix for CVE-2026-53722 allows an application with pages disabled to render a script-capable URL through NuxtLink when attacker-controlled input bound to to is prefixed with an ASCII C0 control character. The no-pages router classifies the value as an internal route before the earlier protocol check and passes it to the rendered anchor href; browsers remove the leading control character and interpret the remaining javascript: URL. The default anchor and NuxtLink custom output are affected, the unsafe href is present in server-rendered HTML, and a victim must click the link for script to execute in the application's origin. This issue is fixed in version 4.6.0.