CVE-2026-56697 Details
Description
Nuxt versions 4.0.0 before 4.4.7 and 3.x before 3.21.7 accept protocol-relative paths such as //evil.com in the reloadNuxtApp function; these pass the script-protocol check but resolve to a cross-origin URL against the current page protocol. Attackers can inject paths like //evil.com to redirect users to attacker-controlled hosts, enabling phishing and OAuth authorization-code theft.
A vulnerability exists in Nuxt.js versions 4.0.0 prior to 4.4.7 and 3.x prior to 3.21.7, allowing open redirects through protocol-relative paths in the reloadNuxtApp function. This issue arises because the function accepts paths like //evil.com, which bypass the script-protocol check and resolve to cross-origin URLs based on the current page protocol. As a result, attackers can redirect users to malicious sites, potentially leading to phishing attacks or theft of OAuth authorization codes.
Users can update to Nuxt version 4.4.7 or 3.21.7, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-601 | URL Redirection to Untrusted Site ('Open Redirect') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| nuxt nuxt | >= 3.0.0, < 3.21.7 >= 4.0.0, < 4.4.7 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 25, 2026 | Initial Analysis | [email protected] |
| Jun 23, 2026 | CVE Modified | CISA-ADP |
| Jun 22, 2026 | New CVE Received | [email protected] |