CVE-2026-56326 Details
Description
Nuxt versions 4.0.0 before 4.4.7 and 3.x before 3.21.7 contain a server-side open redirect vulnerability in navigateTo that fails to properly validate path-normalized payloads like /..//evil.com and /.//evil.com. Attackers can bypass external-host checks using path-normalization techniques to redirect users to attacker-controlled sites via the Location header or meta-refresh, enabling phishing and OAuth authorization-code theft.
A server-side open redirect vulnerability has been identified in Nuxt versions 4.0.0 prior to 4.4.7 and 3.x prior to 3.21.7. The vulnerability resides in the navigateTo function, which fails to properly validate path-normalized payloads. Attackers can exploit this by using path-normalization techniques to bypass external-host checks and redirect users to attacker-controlled sites. This is achieved through the Location header or meta-refresh, potentially leading to phishing attacks or theft of OAuth authorization codes.
Users can update to Nuxt versions 4.4.7 or 3.21.7, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-601 | URL Redirection to Untrusted Site ('Open Redirect') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| nuxt nuxt | >= 3.0.0, < 3.21.7 >= 4.0.0, < 4.4.7 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 25, 2026 | Initial Analysis | [email protected] |
| Jun 23, 2026 | CVE Modified | CISA-ADP |
| Jun 22, 2026 | New CVE Received | [email protected] |