CVE-2024-34343 Overview
CVE-2024-34343 is a cross-site scripting (XSS) vulnerability [CWE-79] in Nuxt, an open-source framework for building full-stack Vue.js applications. The navigateTo function fails to correctly block the javascript: protocol due to parsing discrepancies in the unjs/ufo library it relies on. Attackers can craft malformed URLs containing whitespace or newline characters to bypass protocol validation checks. The issue only impacts applications after server-side rendering (SSR) has occurred. Nuxt released a fix in version 3.12.4.
Critical Impact
Attackers can execute arbitrary JavaScript in a victim's browser session by tricking users into following a specially crafted URL processed by navigateTo.
Affected Products
- Nuxt versions prior to 3.12.4
- Applications using navigateTo for client-side redirection
- SSR-enabled Nuxt deployments consuming user-controlled URLs
Discovery Timeline
- 2024-08-05 - CVE-2024-34343 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-34343
Vulnerability Analysis
The vulnerability resides in Nuxt's navigateTo function, which performs multiple validation steps before allowing redirection. The function first calls hasProtocol from unjs/ufo to detect a protocol in the target URL. It then invokes parseURL to extract structural components and passes the result to isScriptProtocol to block dangerous schemes such as javascript:.
Parsing inconsistencies between these utilities create the bypass. The parseURL function refuses to parse malformed URLs such as javascript:alert(1) and returns empty values for protocol fields. The isScriptProtocol check then receives no protocol to compare and passes the input as safe. This gap allows script-bearing URLs to reach the rendered document.
Root Cause
The root cause is inconsistent URL parsing across hasProtocol, parseURL, and isScriptProtocol in the unjs/ufo library. parseURL does not strip whitespace, and it processes special protocols only when the input matches strict formatting rules. Injecting a newline or tab into the scheme portion of a URL circumvents the special-protocol branch entirely, causing subsequent script-protocol checks to fail open.
Attack Vector
An attacker crafts a URL such as javascript:alert(1) or a variant containing whitespace, tab, or newline characters within the scheme. When a Nuxt application passes this URL to navigateTo during or after SSR, the framework fails to reject it. The browser then evaluates the JavaScript payload in the context of the victim's session, enabling session theft, credential harvesting, or arbitrary DOM manipulation. User interaction is required, typically clicking a crafted link.
No verified public proof-of-concept code is available. See the GitHub Security Advisory GHSA-vf6r-87q4-2vjf for technical details.
Detection Methods for CVE-2024-34343
Indicators of Compromise
- Requests containing javascript: schemes with embedded whitespace, tab, or newline characters in query parameters or path segments
- Application logs recording unexpected redirects originating from navigateTo calls
- Unusual outbound requests from browser sessions immediately following redirection events
Detection Strategies
- Inspect HTTP request logs for URL parameters containing javascript: prefixes or encoded control characters such as %09, %0A, and %0D
- Review Nuxt application dependency manifests for versions of nuxt below 3.12.4
- Deploy runtime monitoring to flag unexpected JavaScript execution in rendered pages
Monitoring Recommendations
- Enable Content Security Policy (CSP) reporting to capture script-source violations
- Monitor web application firewall (WAF) logs for known XSS payload signatures targeting the navigateTo redirect flow
- Correlate browser telemetry with server-side rendering events to identify suspicious redirect chains
How to Mitigate CVE-2024-34343
Immediate Actions Required
- Upgrade Nuxt to version 3.12.4 or later across all environments
- Audit application code for uses of navigateTo that accept user-controlled URLs
- Enforce strict CSP directives that block inline script execution and javascript: URLs
Patch Information
The issue is fixed in Nuxt release 3.12.4. Update the nuxt dependency in package.json and rebuild the application. Refer to the GitHub Security Advisory GHSA-vf6r-87q4-2vjf for release notes and commit references.
Workarounds
- No official workarounds are available; upgrading to 3.12.4 is the only supported remediation
- As a compensating control, validate and sanitize all URLs passed to navigateTo against an allowlist of approved schemes such as http: and https:
- Apply a restrictive CSP as defense-in-depth to reduce XSS impact
# Configuration example
npm install nuxt@^3.12.4
# Verify the installed version
npm ls nuxt
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
