CVE-2026-56326: Nuxt Open Redirect Vulnerability

CVE-2026-56326 Overview

CVE-2026-56326 is a server-side open redirect vulnerability in the Nuxt web framework. The flaw resides in the navigateTo composable, which fails to validate path-normalized payloads such as /..//evil.com and /.//evil.com. Attackers bypass external-host checks using path normalization, redirecting users to attacker-controlled destinations through the Location header or meta-refresh. The vulnerability affects Nuxt 4.0.0 before 4.4.7 and 3.x before 3.21.7. Exploitation enables phishing campaigns and theft of OAuth authorization codes by abusing trusted Nuxt-based domains as redirect intermediaries. The issue is classified under [CWE-601] (URL Redirection to Untrusted Site).

Critical Impact
Attackers can redirect authenticated users from trusted Nuxt applications to malicious sites, enabling credential phishing and OAuth authorization-code interception.

Affected Products

Nuxt 4.0.0 through 4.4.6
Nuxt 3.x prior to 3.21.7
Applications using the navigateTo composable for server-side redirects

Discovery Timeline

2026-06-22 - CVE-2026-56326 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-56326

Vulnerability Analysis

The vulnerability stems from incomplete URL validation in the navigateTo composable located at packages/nuxt/src/app/composables/router.ts. Nuxt's external-host detection logic rejects absolute URLs like https://evil.com but fails to recognize path-normalized payloads as external redirects.

Browsers and HTTP clients normalize sequences like /..//evil.com and /.//evil.com into protocol-relative URLs. After normalization, these payloads resolve to //evil.com, causing the browser to issue a request to the attacker-controlled host. The Nuxt server emits the unsanitized value in the Location response header and in meta-refresh content during server-side rendering.

Root Cause

The root cause is improper input validation of redirect targets before they are written into HTML attributes. The pre-patch implementation encoded the raw location value for HTML attribute output without first applying URL-level encoding that accounts for external-host detection. Path traversal sequences passed through the validator without being normalized prior to the host check.

Attack Vector

An attacker crafts a link to a vulnerable Nuxt application containing a redirect parameter such as ?redirect=/..//evil.com. When the application invokes navigateTo with the attacker-supplied path, the server responds with a 302 redirect carrying a Location header that browsers interpret as //evil.com. The victim lands on the attacker-controlled site while the URL bar briefly displays the trusted origin. This technique is effective against OAuth callback flows where authorization codes can be exfiltrated to attacker domains.

typescript

// Source: https://github.com/nuxt/nuxt/commit/2cce6fb02e621196d56df92e05594e07469b5a6d
       const redirect = async function (response: any) {
         // TODO: consider deprecating in favour of `app:rendered` and removing
         await nuxtApp.callHook('app:redirected')
-        const encodedLoc = encodeForHtmlAttr(location)
         const encodedHeader = encodeURL(location, isExternalHost)
+        const encodedLoc = encodeForHtmlAttr(encodedHeader)

         nuxtApp.ssrContext!['~renderResponse'] = {
           statusCode: sanitizeStatusCode(options?.redirectCode || 302, 302),

The patch reorders the encoding chain so encodeURL is applied first with the isExternalHost flag, and only then is the result passed to encodeForHtmlAttr. This ensures path-normalization payloads are neutralized before being emitted into HTTP headers or HTML attributes.

Detection Methods for CVE-2026-56326

Indicators of Compromise

HTTP requests containing redirect query parameters with path-normalization sequences such as /..//, /.//, or /%2f/
Server-generated Location response headers pointing to protocol-relative external hosts
Unexpected outbound traffic from user browsers immediately following authentication callbacks
OAuth authorization-code requests where the redirect_uri resolves to an unexpected external domain

Detection Strategies

Inspect web server access logs for query parameters containing ..//, .//, or URL-encoded equivalents in redirect-related parameters
Monitor server-side rendered responses for Location headers or meta-refresh tags referencing hosts outside the application's allowlist
Audit Nuxt application code for calls to navigateTo that consume untrusted user input without explicit allowlist validation

Monitoring Recommendations

Enable web application firewall (WAF) rules that flag path traversal patterns in redirect query parameters
Log all 3xx responses with their Location header values and alert on external destinations
Track OAuth flows for anomalous redirect_uri values that deviate from registered callback URLs

How to Mitigate CVE-2026-56326

Immediate Actions Required

Upgrade Nuxt to version 4.4.7 or later for the 4.x branch
Upgrade Nuxt to version 3.21.7 or later for the 3.x branch
Review all uses of navigateTo in application code and apply strict allowlist validation for redirect targets
Audit OAuth callback handlers for reliance on navigateTo with user-controlled input

Patch Information

Nuxt maintainers released the fix in commits 1f2dd5e and 2cce6fb. Details are documented in the GitHub Security Advisory GHSA-c9cv-mq2m-ppp3 and the VulnCheck Advisory on Nuxt.

Workarounds

Validate redirect targets against a strict server-side allowlist before passing values to navigateTo
Reject any redirect parameter containing .., \, or multiple consecutive slashes prior to processing
Force redirects to be relative by parsing and reconstructing the path component only
Deploy WAF rules that block path-normalization sequences in known redirect parameter names

bash

# Upgrade Nuxt to a patched version
npm install nuxt@^4.4.7
# or for the 3.x branch
npm install nuxt@^3.21.7